Splunk Enterprise

Can I change the static dropdown option selected in one dashboard using a drilldown from another?


I have two dashboards. The first lower level dashboard has a dropdown to select between multiple hosts of the same type to view diagnostic information among other things. The second higher level dashboard has status indicators which represents the overall "health" of hosts. These status indicators are pre-built panels which are present in both the higher level and lower level dashboards.

The status indicators do not have drilldown functionality. As such, my workaround is to use a statistics table under each status indicator which only displays "Click_Here". This works just fine to send the user to the desired dashboard. However, if the user selects the drilldown related to a particular host, I would like that host to be selected in the lower level dashboards dropdown as this will change what panels and status indicators are displayed dynamically. The lower level dashboards dropdown token is used in multiple base searches as well as a number of visualizations. The selection of the dropdown is also used to hide and show panels through a series of <change><condition> tags and tokens.

This is an example of my lower level dropdown XML:

<input type="dropdown" token="HOST_SELECTION">
      <choice value="host1">host1</choice>
      <choice value="host2">host2</choice>
      <choice value="host3">host3</choice>
        <condition label="host1">
          <set token="HostType1_Indicator_Tok">true</set>
          <unset token="HostType2_Indicator_Tok">false</unset>
          <set token="Host1_Tok">true</set>
          <unset token="Host2_Tok">false</unset>
          <unset token="Host3_Tok">false</unset>

Any input is appreciated. Thank you.

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...