Dashboards & Visualizations

Set and use tokens from a (hidden) panel without clicking on it.

Path Finder


I have 3 panels on a single dashboard.

The first panel is visible where it TABLEs out a list of events which you can click on.
The second panel is hidden and is waiting on the value you click on from the first panel and runs a search and displays more events in a TABLE.
The third panel is also hidden and populated by the first and second panels then writes to a kvstore

Problem I'm having is passing the tokens from the second panel to the third panel. Example below:

My snippet of the second panel from XML


          my search <token from panel1>... | table field1 field2


            <condition match="'job.resultCount' > 0">
              <set token="set_field1_tok">$row.field1$</set>
              <set token="set_field2_tok">$row.field2$</set>
              <set token="fix_earliest">-15m</set>
              <set token="fix_latest">now</set>


    <option name="count">10</option>
    <option name="drilldown">cell</option>

when I call $setfield1tok$ and/or $setfield2tok$ in panel3 I literally get the values "$row.field1$" and "$row.field2$" and not the expected field value. Am I doing this right? Or is this wrong?


0 Karma
1 Solution


Use the <done> handler instead of the <progress>. Also you need to use $row.< field_name >$.

More information about the tokens: http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/PanelreferenceforSimplifiedXML#Predefined_dril...

Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma

Path Finder

hello, i did change my 'progress' flags to 'done'. Also my code shows i am already using $row.field_value$.

From what i'm reading, it sounds like it has to be a drilldown/CLICKED value. it can't just be set from a search finishing and pulling the fields from the finished search.

The way i have it set, it just sets the token as the literal words "$row.field_name$" and not expected field values.

0 Karma