Splunk Enterprise

Can I change the static dropdown option selected in one dashboard using a drilldown from another?

twidler
Explorer

I have two dashboards. The first lower level dashboard has a dropdown to select between multiple hosts of the same type to view diagnostic information among other things. The second higher level dashboard has status indicators which represents the overall "health" of hosts. These status indicators are pre-built panels which are present in both the higher level and lower level dashboards.

The status indicators do not have drilldown functionality. As such, my workaround is to use a statistics table under each status indicator which only displays "Click_Here". This works just fine to send the user to the desired dashboard. However, if the user selects the drilldown related to a particular host, I would like that host to be selected in the lower level dashboards dropdown as this will change what panels and status indicators are displayed dynamically. The lower level dashboards dropdown token is used in multiple base searches as well as a number of visualizations. The selection of the dropdown is also used to hide and show panels through a series of <change><condition> tags and tokens.

This is an example of my lower level dropdown XML:

<input type="dropdown" token="HOST_SELECTION">
      <label>Host</label>
      <choice value="host1">host1</choice>
      <choice value="host2">host2</choice>
      <choice value="host3">host3</choice>
      <default>host1</default>
      <initialValue>host1</initialValue>
      <change>
        <condition label="host1">
          <set token="HostType1_Indicator_Tok">true</set>
          <unset token="HostType2_Indicator_Tok">false</unset>
          <set token="Host1_Tok">true</set>
          <unset token="Host2_Tok">false</unset>
          <unset token="Host3_Tok">false</unset>
        </condition>
Etc...

Any input is appreciated. Thank you.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...