Set and use tokens from a (hidden) panel without clicking on it.

[johnmvang]

Hello,

I have 3 panels on a single dashboard.

The first panel is visible where it TABLEs out a list of events which you can click on.
The second panel is hidden and is waiting on the value you click on from the first panel and runs a search and displays more events in a TABLE.
The third panel is also hidden and populated by the first and second panels then writes to a kvstore

Problem I'm having is passing the tokens from the second panel to the third panel. Example below:

My snippet of the second panel from XML

       <search>

          <query>
          my search <token from panel1>... | table field1 field2
          </query>

          <earliest>-15m</earliest>
          <latest>now</latest>

          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="set_field1_tok">$row.field1$</set>
              <set token="set_field2_tok">$row.field2$</set>
              <set token="fix_earliest">-15m</set>
              <set token="fix_latest">now</set>
            </condition>
          </progress>

        </search>

    <option name="count">10</option>
    <option name="drilldown">cell</option>

when I call $set_field1_tok$ and/or $set_field2_tok$ in panel3 I literally get the values "$row.field1$" and "$row.field2$" and not the expected field value. Am I doing this right? Or is this wrong?

Thanks.

[johnmvang · Accepted solution]

answer can be found here:

https://answers.splunk.com/answers/696030/is-there-anyway-to-pass-rowfield-name-without-clic.html

[diogofgm]

Hi
Use the <done> handler instead of the <progress>. Also you need to use $row.< field_name >$.

More information about the tokens: http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/PanelreferenceforSimplifiedXML#Predefined_dril...

[johnmvang]

hello, i did change my 'progress' flags to 'done'. Also my code shows i am already using $row.field_value$.

From what i'm reading, it sounds like it has to be a drilldown/CLICKED value. it can't just be set from a search finishing and pulling the fields from the finished search.

The way i have it set, it just sets the token as the literal words "$row.field_name$" and not expected field values.