Set multiple tokens on a single Table view

siddhartha_dada · ‎05-15-2019

Hello

I am trying to see how we can set two tokens on a table below. What ever I try, only seem to be able to get one value at a time. Is it possible to allow users to click on two values in a table and once they click on Submit, pass those tokens over for downstream searches?

Group1
A
B
C
D

Setting the drilldown as

   <drilldown>
          <set token="GAP1">$click.value$</set>
          <set token="GAP2">$click.value1$</set>
   </drilldown>

Want to write the HTML as

 Your Picks: $click.value$, $click.value1$ -- Tried this and it always should a single value in both.

DavidHourani · ‎05-16-2019

Make sure you're leveraging the tokens you created 🙂

You defined GAP1 and GAP2 so use them in your HTML. So is should be like this :

  Your Picks: $GAP1$, $GAP2$

kamlesh_vaghela · ‎05-16-2019

@siddhartha.dadana

You have to use GAP1 and GAP2 in HTML panel.

See below example.

<dashboard>
<row>
    <panel>
      <title>Sample Table</title>
      <table>
        <title>A</title>
        <search>
          <query>| makeresults count=10| eval number=1 | accum number</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="GAP1">$click.value$</set>
          <set token="GAP2">$click.value2$</set>
        </drilldown>
      </table>
    </panel>
    <panel>
      <title>HTML Panel</title>
      <html>
        click_value : $GAP1$ <br/>
        click_value2 : $GAP2$
      </html>
    </panel>
  </row>
</dashboard>

Set multiple tokens on a single Table view

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Join the Conversation

Set multiple tokens on a single Table view

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence