Dashboards & Visualizations

Token passed from one dashboard to another dashboard is being set to * automatically

moonie
Explorer

I have two dashboards I am currently working with.
On the first dashboard I have two column chart panels, where the second one is based on the first one. So if I click on a column on the first chart it sets a token, based on this token the other panel appears with its results.
Now if I click on one of those columns I want to set a second token. So far so good.
I want to send these tokens as inputs for the second dashboard where I need to work with them. The first token should be passed to a dropdown input which works perfectly fine, no troubles here. The second token on the other hand needs to be passed to a multiselect input, which somehow doesn't work. The passing itself works perfectly fine, the url I get when opening the new tab to the other dashboard is good, but it somehow automatically changes the second token to a asterisk *.
I tried tiping the url manually but it still happens, so I think something is wrong with the second dashboard. I guess there may be a problem with my inputs, since every input I have is based on another input, like a "higher level" input. My code is like this:

 

<fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="first_level">
      <label>1st Group</label>
      <prefix>1st_level="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>1st_level</fieldForLabel>
      <fieldForValue>1st_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) 
| search parent_group="CEO"
| stats count by 1st_level</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <unset token="form.2nd_level"></unset>
        <unset token="form.3rd_level"></unset>
        <unset token="form.4th_level"></unset>
        <unset token="form.5th_level"></unset>
      </change>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="multiselect" token="2nd_level">
      <label>Second Level Group</label>
      <prefix>(</prefix>
      <suffix> OR 2nd_level="n/a")</suffix>
      <valuePrefix>2nd_level="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>2nd_level</fieldForLabel>
      <fieldForValue>2nd_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) 
| search parent_group="CEO"
| search $1st_level$
| stats count by 2nd_level
</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="multiselect" token="3rd_level">
      <label>Third level group</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>(</prefix>
      <suffix> OR 3rd_level="n/a")</suffix>
      <initialValue>*</initialValue>
      <valuePrefix>3rd_level="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>3rd_level</fieldForLabel>
      <fieldForValue>3rd_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) , 3rd_level=if(parent_group_count&gt;=4, mvindex(parent_group, -4), "n/a")
| search parent_group="CEO" 
| search $1st_level$ $2nd_level$
| search 2nd_level!="n/a"
| stats count by bc_name_2nd</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>

 

I have two more deeper inputs, but I think you know how they work now. At first I thought the problem was resulting from the preselected "All" value, but when I changed to to nothing it didn't help.
My guess is that it's coming from the Queries that are based on the higher level input, but I have no clue how I can prevent that without losing the token search filters.
Any help is highly appreciated!! I've been stuck on this problem for hours now. 😞

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...