Dashboards & Visualizations

simple xml drilldown evaluated token value isn't passed into a link url string

dperrands
Explorer

Hi, i've been trying to fix  this for the last 4 hours.  I'm evaluating a value in a drilldown.  

The evaluated value isn't literally being passed into the link token value i've specified.  Instead the token name is being passed into the link. 

I've looked through the docs and similar issues in this forum but nothing explains the problem i'm having.  I'm on Splunk Version 6.2.5 Splunk  Build 272645

Simple xml below

Any help would be amazing.

 

 

 

        <drilldown target="blank">
          <eval token="trunc_host">rex field=host mode=sed "s/\d+/"*"/g"|</eval>

          <link>

		<![CDATA[
          Integration_PRA_capacity_breakdown?form.host=$trunc_host$&form.stack=$row.stack$&earliest=-h$&latest=now
         ]]>
            
          </link>
        </drilldown>

 

 

 

This is the url generated

 

https://url/app/excd/Int_PR_city_break?form.host=%24trunc_host%24&form.stack=inst&earliest=-h%24&lat...

 

Labels (3)
0 Karma
1 Solution

LHAYNES020
Explorer

Are you able to evaluate the value in the query like my example above? Perhaps if you can show what the rest of the panel looks like, we can find a place to set it that isn't in the drilldown itself.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I looks like there's an extra $ in the link (after "earliest=-h") that may cause other problems.

I believe the eval is not populating the trunc_host token because the rex command does not return a value to assign to it.  Try using the replace function, instead.

<eval token="trunc_host">replace(host, "\d+","*")</eval>

 

---
If this reply helps you, Karma would be appreciated.

dperrands
Explorer

Thanks for taking the time to have a look.

I removed the extra $.

Although my original eval query returns a value when i perform the search separately i tried yours.  It seems a more elegant solution too.  

Unfortunately the same erroneous url is generated. 

 

form.host=%24trunc_host%24&form.stack=inst&earliest=-h&latest=now

 

Any other ideas?

0 Karma

LHAYNES020
Explorer

I had the same problem and just came to a solution that may not be the most efficient, but is at least working for me.

I set the field value in the query itself and then had the search set a token on completion instead of in the drilldown. That seems to be correctly passing the value instead of the name.

      <table>
        <title>Google Test</title>
        <search>
          <done>
            <set token="link">$result.link$</set>
          </done>
          <query>|makeresults| eval link="google"|table *</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">https://$link$.com</link>
        </drilldown>
      </table>

 

dperrands
Explorer

Thanks for this response.  I need to evaluate the value I’m trying to pass to the token.  I can’t seem to do this with the set token attribute. ☹️

0 Karma

LHAYNES020
Explorer

Are you able to evaluate the value in the query like my example above? Perhaps if you can show what the rest of the panel looks like, we can find a place to set it that isn't in the drilldown itself.

dperrands
Explorer

Thanks for your help here, it works!

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...