Two similar dashboards sharing a single deep dive page filled by tokens

[bworrellZP]

So I have two huge dashboards for two different indexes. These dashboard are for a current version of our app and for a customized version for a few select customers. Data is similar, for this request, but for the other data, fields vary.

These dashboard track 4 fields each. Call them Client, Access Count, Username, total errors. (these are the four fields which are the same in both dashboard.

Right now when I want to do a deeper dive to see why Client 1 has lots of errors and add the detail fields, I click on them and then add the table string to my search. All manual.

I know I can create a new page and pass the Client in a token, and have that search already there. What I Would like to do, is make one new deep dive dashboard and have both of these pass the client and index through as tokens. Since the index is not in the table, how would I pass that through to the new deep dive dashboard?

[woodcock · Accepted solution]

I assume that each dashboard panel has a unique index that is always associated with that panel so just set it on drilldown like this:

<drilldown>
   <set token="myIndex">HardCodedPerPanelIndexValueHere</set>
   ...
</drilldown>

Then use $myIndex$ in the combined drilldown panel.

[bworrellZP]

Using what you presented, I added this in the source to my table (starting the testing with just the index)

    <drilldown>
                  <set token="myIndex">patient_portal_login</set>
          <link>https://splunksearch:8000/en-US/app/search/client?form.limit=$myIndex$</link>
        </drilldown>

That takes me to the second page, and in the address bar, I see the proper index name, though nothing occurs on the second page (not sure what I am missing, have one other app where I pass a click value through, that works, though set it up in Splunk 6.3, so its been a while).

Here is the code for the second page.

        <form>
        <label>Drill down</label>

         <row>
            <table id="master">
                <title>Master</title>
                <search>
                    <query>index=$myIndex$ earliest=-1d@d latest=-0d@d </query>
                    <earliest>-1d@d</earliest>
                    <latest>-0d@d</latest>
                </search>

            </table>
        </row>

    </form>

Thanks

[bworrellZP]

Okay, through some trial and error I figured out the issues and have it working now.

Documentation about this could use some additional updates.

That said, is there a way to hide the input boxes on the detailed dashboard?

[woodcock]

Be sure to go to the weak docs page and leave specific feedback in the Comments area; the docs team is VERY receptive to good (and bad) feedback and get right on it to make improvements.

[woodcock]

You can use the depends directive to hide dashboard elements (it is not just for panels):

https://answers.splunk.com/answers/188709/how-to-display-dashboard-panels-dynamically.html

[woodcock]

Please either elaborate in a comment here exactly what needed adjusting OR post your own complete answer. This is so that others can learn, too. Be sure to close the Question by clicking Accept.