Dashboards & Visualizations

Why won't drilldown AND conditions work?

wangkevin1029
Communicator

Hi, Splunkers,

I have a condition drilldown, when I only had one condition <condition match="$t_DrillDown$ = &quot;*&quot">,  it works,   

but when I added another condition len($Gucid_token$) = 20, and click some field, which passes $Gucid_token$ as input,   my two dashboard included here are not opened, instead  a basic splunk search is opened.

 

<condition match="$t_DrillDown$ = &quot;*&quot; AND  len($Gucid_token$) = 20">
  <link target="_blank">
    <![CDATA[
      /app/optum_gvp/pivr_search?form.i_callGUID=$click.value2$&form.i_time1.earliest=$row.StartDTM_epoch$&form.i_time1.latest=$row.EndDTM_epoch$
       ]]>
   </link>
   <link target="_blank">
      <![CDATA[
        /app/optum_gvp/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token_with2handlers=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$
      ]]>
   </link>
</condition>

 

why added another condition  len($Gucid_token$) = 20 caused drilldown not open two dashboards , but open a basic splunk query?

 

thx.

 

Kevin

Labels (1)
0 Karma
1 Solution

wangkevin1029
Communicator

it looks I used wrong token.

 

after I changed $Gucid_token$  to  $click.value2$, it works.

 

Kevin

View solution in original post

wangkevin1029
Communicator

it looks I used wrong token.

 

after I changed $Gucid_token$  to  $click.value2$, it works.

 

Kevin

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...