Solved: set & unset token based on click.name2 in chart

dorHerbesman · ‎01-06-2025

Im trying to set and unset a filter (manage token) based on click.name2 - if form.Tail=* i want to put click.name2, and if it's not * i want to put * (by that unsetting the token)

I've tried 3 approaches and all had prolems.

this is the chart config:

<chart>
<title>amount of warning per file per Tail</title>
<search base="basesearch">
<query>|search
| search "WARNNING: "
| rex field=_raw "WARNNING: (?&lt;warnning&gt;(?s:.*?))(?=\n\d{5}|$)"
| search warnning IN $warning_type$
| search $project$
| search $platform$
| chart count over source by Tail</query>
</search>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="form.Tail">$click.name2$</set>
</drilldown>
</chart>

when i try something like that:

 <drilldown>
<eval token="form.Tail">if("$form.Tail$"==* OR "$form.Tail$"=="ALL", "$click.name2$",*)</eval>
</drilldown>

nothing happens (i also tried something simpler like           <eval token="form.Tail">if($form.Tail$ != $click.name2$, 111,222)</eval> but still nothing happens)

when i try this:

<eval token="form.Tail">if("$form.Tail$" == "$click.name2$", "*", "$click.name2$")</eval>

it just puts $click.name2$ in the token

when i try:

 <drilldown>
<condition match="form.Tail==*">
<set token="form.Tail">$click.name2$</set>
</condition>
<condition match="form.Tail!=*">
<set token="form.Tail">*</set>
</condition>        
</drilldown>

instead of managing token in the dashboard it open as search on the current tab by there exiting the dashboard.

what am i doing wrong here?

thanks in advanced to all helpers 🙂

bowesmana · ‎01-08-2025

Just use this in the drilldown

<eval token="form.Tail">if($click.name2$=$form.Tail$, "*", $click.name2$)</eval>

So, if the clicked value is the same as the current form value, then it sets the form value to * (which in my example is the value for the All dropdown option) otherwise it sets the form value to the clicked legend.

Full working example below

<form version="1.1" theme="light">
  <label>Tail</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="Tail" searchWhenChanged="true">
      <label>Tail</label>
      <choice value="*">All</choice>
      <choice value="1">1</choice>
      <choice value="2">2</choice>
      <choice value="3">3</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>| makeresults count=60
| eval Tail=random() % 3
| streamstats c
| eval r=random() % 100
| eval source=random() % 10
| search Tail=$Tail$
| chart count over source by Tail</query>
          <earliest>-30m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <eval token="form.Tail">if($click.name2$=$form.Tail$, "*", $click.name2$)</eval>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

View solution in original post

bowesmana · ‎01-07-2025

Few questions.

1. You are not using the input token form.Tail in your post processing search. Is it used in the base search?

2. What are you clicking to expect something to occur? The <set> statement you have WILL set the input token in the display to be the clicked Tail value if you click the LEGEND of the column chart.

3. It looks like you are using base searches incorrectly. Base searches are NOT intended to hold RAW data, they are designed to hold aggregated data that has been transformed in some way - see this article

https://docs.splunk.com/Documentation/Splunk/9.4.0/Viz/Savedsearches#Post-process_searches_2

You are likely to make performance worse by not using a transforming search in a base search and in any case, base searches have result limits.

I am guessing your dashboard is something like this (note, please post using the code sample option in the menu <> when posting code.

<form version="1.1" theme="light">
  <label>Tail</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="Tail" searchWhenChanged="true">
      <label>Tail</label>
      <choice value="*">All</choice>
      <choice value="1">1</choice>
      <choice value="2">2</choice>
      <choice value="3">3</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>| makeresults count=60
| eval Tail=random() % 3
| streamstats c
| eval r=random() % 100
| eval Tail=if(r&lt;30,"*",Tail)
| eval source=random() % 10
| search Tail=$Tail$
| chart count over source by Tail</query>
          <earliest>-30m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="form.Tail">$click.name2$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <html>$form.Tail$</html>
    </panel>
  </row>
</form>

You can see that when you click the legend this will change the input to what you have clicked if you click the legend.

Can you clarify exactly what is NOT working and what you are actually doing that does NOT work

dorHerbesman · ‎01-07-2025

1. form.Tail is used to not only change the token of Tail but to also set the filter Tail to be $Tail$ value

2) I am clicking on the legend of a chart where the values (names) there are the numbers of the tails *for eaxmple 120, 170 200 etc..), on the first click it's setting the token of $tail$ to be the legend i clicked which is working great, what not going great is on the second click to unset the token.

3) the base search is doing aggragation by other filters and is doing some of the thinking and indeed save loading times (tested before and after).

bowesmana · ‎01-08-2025

Just use this in the drilldown

<eval token="form.Tail">if($click.name2$=$form.Tail$, "*", $click.name2$)</eval>

So, if the clicked value is the same as the current form value, then it sets the form value to * (which in my example is the value for the All dropdown option) otherwise it sets the form value to the clicked legend.

Full working example below

<form version="1.1" theme="light">
  <label>Tail</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="Tail" searchWhenChanged="true">
      <label>Tail</label>
      <choice value="*">All</choice>
      <choice value="1">1</choice>
      <choice value="2">2</choice>
      <choice value="3">3</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>| makeresults count=60
| eval Tail=random() % 3
| streamstats c
| eval r=random() % 100
| eval source=random() % 10
| search Tail=$Tail$
| chart count over source by Tail</query>
          <earliest>-30m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <eval token="form.Tail">if($click.name2$=$form.Tail$, "*", $click.name2$)</eval>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

dorHerbesman · ‎01-08-2025

this was the solution!

please explain to me why:

<eval token="form.Tail">if($click.name2$=$form.Tail$, "*", $click.name2$)</eval>

works but:

<eval token="form.Tail">if("$form.Tail$"==* OR "$form.Tail$"=="ALL", "$click.name2$",*)</eval>

didn't?

it seems to me im just asking to opposit questions and switching the reponse to match.

bowesmana · ‎01-08-2025

It's quotes - you are using * without quotes, so it's invalid eval - sometimes it's hard to debug eval token setters in dashboards, but generally if you find that nothing appears to happen when you have an <eval> token setter, it's probably getting an error.

I often have a panel behind depends="$debug_tokens$" that has an html panel that reports token values, which I can turn on as needed.

Also on the dashboard examples app there is a showtokens.js which can help you uncover token issues.

set & unset token based on click.name2 in chart

chart

panel

token

Unleash Unified Security and Observability with Splunk Cloud Platform

Splunk AppDynamics with Cisco Secure Application

New Splunk Innovations Enhance Performance and Accelerate Troubleshooting