I have 3 panels on a single dashboard.
The first panel is visible where it TABLEs out a list of events which you can click on.
The second panel is hidden and is waiting on the value you click on from the first panel and runs a search and displays more events in a TABLE.
The third panel is also hidden and populated by the first and second panels then writes to a kvstore
Problem I'm having is passing the tokens from the second panel to the third panel. Example below:
My snippet of the second panel from XML
<search> <query> my search <token from panel1>... | table field1 field2 </query> <earliest>-15m</earliest> <latest>now</latest> <progress> <condition match="'job.resultCount' > 0"> <set token="set_field1_tok">$row.field1$</set> <set token="set_field2_tok">$row.field2$</set> <set token="fix_earliest">-15m</set> <set token="fix_latest">now</set> </condition> </progress> </search> <option name="count">10</option> <option name="drilldown">cell</option>
when I call $setfield1tok$ and/or $setfield2tok$ in panel3 I literally get the values "$row.field1$" and "$row.field2$" and not the expected field value. Am I doing this right? Or is this wrong?
<done> handler instead of the
<progress>. Also you need to use
$row.< field_name >$.
More information about the tokens: http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/PanelreferenceforSimplifiedXML#Predefined_dril...
hello, i did change my 'progress' flags to 'done'. Also my code shows i am already using $row.field_value$.
From what i'm reading, it sounds like it has to be a drilldown/CLICKED value. it can't just be set from a search finishing and pulling the fields from the finished search.
The way i have it set, it just sets the token as the literal words "$row.field_name$" and not expected field values.