Splunk Enterprise

Can I change the static dropdown option selected in one dashboard using a drilldown from another?

twidler
Explorer

I have two dashboards. The first lower level dashboard has a dropdown to select between multiple hosts of the same type to view diagnostic information among other things. The second higher level dashboard has status indicators which represents the overall "health" of hosts. These status indicators are pre-built panels which are present in both the higher level and lower level dashboards.

The status indicators do not have drilldown functionality. As such, my workaround is to use a statistics table under each status indicator which only displays "Click_Here". This works just fine to send the user to the desired dashboard. However, if the user selects the drilldown related to a particular host, I would like that host to be selected in the lower level dashboards dropdown as this will change what panels and status indicators are displayed dynamically. The lower level dashboards dropdown token is used in multiple base searches as well as a number of visualizations. The selection of the dropdown is also used to hide and show panels through a series of <change><condition> tags and tokens.

This is an example of my lower level dropdown XML:

<input type="dropdown" token="HOST_SELECTION">
      <label>Host</label>
      <choice value="host1">host1</choice>
      <choice value="host2">host2</choice>
      <choice value="host3">host3</choice>
      <default>host1</default>
      <initialValue>host1</initialValue>
      <change>
        <condition label="host1">
          <set token="HostType1_Indicator_Tok">true</set>
          <unset token="HostType2_Indicator_Tok">false</unset>
          <set token="Host1_Tok">true</set>
          <unset token="Host2_Tok">false</unset>
          <unset token="Host3_Tok">false</unset>
        </condition>
Etc...

Any input is appreciated. Thank you.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...