Dashboards & Visualizations

Token passed from one dashboard to another dashboard is being set to * automatically

moonie
Explorer

I have two dashboards I am currently working with.
On the first dashboard I have two column chart panels, where the second one is based on the first one. So if I click on a column on the first chart it sets a token, based on this token the other panel appears with its results.
Now if I click on one of those columns I want to set a second token. So far so good.
I want to send these tokens as inputs for the second dashboard where I need to work with them. The first token should be passed to a dropdown input which works perfectly fine, no troubles here. The second token on the other hand needs to be passed to a multiselect input, which somehow doesn't work. The passing itself works perfectly fine, the url I get when opening the new tab to the other dashboard is good, but it somehow automatically changes the second token to a asterisk *.
I tried tiping the url manually but it still happens, so I think something is wrong with the second dashboard. I guess there may be a problem with my inputs, since every input I have is based on another input, like a "higher level" input. My code is like this:

 

<fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="first_level">
      <label>1st Group</label>
      <prefix>1st_level="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>1st_level</fieldForLabel>
      <fieldForValue>1st_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) 
| search parent_group="CEO"
| stats count by 1st_level</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <unset token="form.2nd_level"></unset>
        <unset token="form.3rd_level"></unset>
        <unset token="form.4th_level"></unset>
        <unset token="form.5th_level"></unset>
      </change>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="multiselect" token="2nd_level">
      <label>Second Level Group</label>
      <prefix>(</prefix>
      <suffix> OR 2nd_level="n/a")</suffix>
      <valuePrefix>2nd_level="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>2nd_level</fieldForLabel>
      <fieldForValue>2nd_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) 
| search parent_group="CEO"
| search $1st_level$
| stats count by 2nd_level
</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="multiselect" token="3rd_level">
      <label>Third level group</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>(</prefix>
      <suffix> OR 3rd_level="n/a")</suffix>
      <initialValue>*</initialValue>
      <valuePrefix>3rd_level="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>3rd_level</fieldForLabel>
      <fieldForValue>3rd_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) , 3rd_level=if(parent_group_count&gt;=4, mvindex(parent_group, -4), "n/a")
| search parent_group="CEO" 
| search $1st_level$ $2nd_level$
| search 2nd_level!="n/a"
| stats count by bc_name_2nd</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>

 

I have two more deeper inputs, but I think you know how they work now. At first I thought the problem was resulting from the preselected "All" value, but when I changed to to nothing it didn't help.
My guess is that it's coming from the Queries that are based on the higher level input, but I have no clue how I can prevent that without losing the token search filters.
Any help is highly appreciated!! I've been stuck on this problem for hours now. 😞

Labels (1)
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...