Dashboards & Visualizations

Token passed from one dashboard to another dashboard is being set to * automatically

moonie
Explorer

I have two dashboards I am currently working with.
On the first dashboard I have two column chart panels, where the second one is based on the first one. So if I click on a column on the first chart it sets a token, based on this token the other panel appears with its results.
Now if I click on one of those columns I want to set a second token. So far so good.
I want to send these tokens as inputs for the second dashboard where I need to work with them. The first token should be passed to a dropdown input which works perfectly fine, no troubles here. The second token on the other hand needs to be passed to a multiselect input, which somehow doesn't work. The passing itself works perfectly fine, the url I get when opening the new tab to the other dashboard is good, but it somehow automatically changes the second token to a asterisk *.
I tried tiping the url manually but it still happens, so I think something is wrong with the second dashboard. I guess there may be a problem with my inputs, since every input I have is based on another input, like a "higher level" input. My code is like this:

 

<fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="first_level">
      <label>1st Group</label>
      <prefix>1st_level="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>1st_level</fieldForLabel>
      <fieldForValue>1st_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) 
| search parent_group="CEO"
| stats count by 1st_level</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <unset token="form.2nd_level"></unset>
        <unset token="form.3rd_level"></unset>
        <unset token="form.4th_level"></unset>
        <unset token="form.5th_level"></unset>
      </change>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="multiselect" token="2nd_level">
      <label>Second Level Group</label>
      <prefix>(</prefix>
      <suffix> OR 2nd_level="n/a")</suffix>
      <valuePrefix>2nd_level="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>2nd_level</fieldForLabel>
      <fieldForValue>2nd_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) 
| search parent_group="CEO"
| search $1st_level$
| stats count by 2nd_level
</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="multiselect" token="3rd_level">
      <label>Third level group</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>(</prefix>
      <suffix> OR 3rd_level="n/a")</suffix>
      <initialValue>*</initialValue>
      <valuePrefix>3rd_level="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>3rd_level</fieldForLabel>
      <fieldForValue>3rd_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) , 3rd_level=if(parent_group_count&gt;=4, mvindex(parent_group, -4), "n/a")
| search parent_group="CEO" 
| search $1st_level$ $2nd_level$
| search 2nd_level!="n/a"
| stats count by bc_name_2nd</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>

 

I have two more deeper inputs, but I think you know how they work now. At first I thought the problem was resulting from the preselected "All" value, but when I changed to to nothing it didn't help.
My guess is that it's coming from the Queries that are based on the higher level input, but I have no clue how I can prevent that without losing the token search filters.
Any help is highly appreciated!! I've been stuck on this problem for hours now. 😞

Labels (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...