Splunk Enterprise

Help to use token drilldown with an html link

jip31
Motivator

hello

In a first dashboard, i use 2 dropdown list

the first dropdown list concerns a relative time choice and the second dropdown list concern a site choice

I need to retrieve in a second dashboard (there is also the same dropdown list in this dash)  the choice done from these 2 dropdown list by executing html link

 

 

<form>
  <label>TEST</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="period">
      <label>Période</label>
      <choice value="1654466400.0">Lundi 6 Juin 2022</choice>
      <choice value="1655071200.0">Lundi 13 Juin 2022</choice>
      <choice value="1655676000.0">Lundi 20 Juin 2022</choice>
      <choice value="1656280800.0">Lundi 27 Juin 2022</choice>
      <change>
        <eval token="debut">period</eval>
        <eval token="fin">debut+432000</eval>
        <eval token="debut_4w">relative_time(debut,"-4w")</eval>
        <eval token="fin_4w">relative_time(debut,"-0w")</eval>
      </change>
      <default>1655071200.0</default>
      <initialValue>1655071200.0</initialValue>
    </input>
    <input type="dropdown" token="site" searchWhenChanged="true">
      <label>Espace </label>
      <fieldForLabel>site</fieldForLabel>
      <fieldForValue>site</fieldForValue>
      <search>
        <query>`index_mes` 
| dedup site 
| table site 
| sort + site</query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">*</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
       <a href="/app/spl_pub/bpe?form.site=$form.site|u$&amp;form.period.earliest=$form.period$&amp;form.period.latest=$form.period$" target="_blank">Cliquez ici</a>

    </html>
    </panel>
  </row>

 

 

it works for the site by adding | search site="$form.site$"  in the second dashboard for every search but it doesnt works for the time

so what is wrong in the html link and how to take into account the time choice done in the first dashboard in the second dashboard?

thanks

 

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @jip31,

Please try below syntax on destination dashboard. Since secondary tokens are not triggered on change, you should use set instead of eval and also $value$ token to get the period contents after change.

<change>
        <set token="debut">$value$</set>
        <eval token="fin">debut+432000</eval>
        <eval token="debut_4w">relative_time(debut,"-4w")</eval>
        <eval token="fin_4w">relative_time(debut,"-0w")</eval>
</change>
 
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @jip31,

Please try below syntax on destination dashboard. Since secondary tokens are not triggered on change, you should use set instead of eval and also $value$ token to get the period contents after change.

<change>
        <set token="debut">$value$</set>
        <eval token="fin">debut+432000</eval>
        <eval token="debut_4w">relative_time(debut,"-4w")</eval>
        <eval token="fin_4w">relative_time(debut,"-0w")</eval>
</change>
 
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

jip31
Motivator

Hi!

Thanks not it works fine!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

2 issues:

1. Does your second dashboard have inputs? The point of using "form".XXX in the URL is that a token prefixed with FORM is an input element in the target dashboard. If you just are looking to pass a token to the other dashboard which can be used in the dashboard and there are no inputs, then simply pass the token like this

<a href="/app/spl_pub/bpe?site=$form.site$ earliest=$form.debut_4w$ latest=$form.fin_4w$...

Then in your second dashboard, you can include this in the search 

your_search earliest=$earliest$ latest=$latest$

 

2. If you DO have inputs in the second dashboard, then if you have one with token period AND it is a time picker input, then the syntax you have appears correct, but if it is NOT a time picker in the second dashboard, then form.period.earliest/latest syntax does not apply.

 

Also, I am wondering if you mean to be passing the debut/fin tokens rather than period as period only has a single value passed to the second dashboard - is that what you intended?

 

0 Karma

jip31
Motivator

Not sure to understand everyting but

1 -  The second dashboard is a detailed view of the first dasboard but it doesnt means that the panel in the second dashboard has the same role that the panel in the first dashboard

In other words, I just want to retrieve in the second dashboard the choice done in the first dashboard from the 2 dropdown list

So when I choose a site and a period in the first dashboard, I need to retrieve the same choice in the second dashboard

It works for the site but not for the period

In order to test, I have added the same period dropdown list in the second dashboard as in the first dashboard

And the only way to retrieve the same period is to use this HTML link in te first dashboard

 

 <a href="/app/spl_pub/bp?form.site=$form.site|u$&amp;form.period=$form.period$"

 

So the solution will be to link the period dropdown list of the second dashboard with each panel of the dashboard but i dont succeed...

I tried with

| search site="$form.site$" AND period=$period$

in the search

and

jip31_0-1663571947984.png

2 - I just want to retieve in the second dashboard the period choice done in the first dashboard for these 4 tokens

 

 <eval token="debut">period</eval>
        <eval token="fin">debut+432000</eval>
        <eval token="debut_4w">relative_time(debut,"-4w")</eval>
        <eval token="fin_4w">relative_time(debut,"-0w")</eval>

 

 

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If a dashboard has an input, then in the URL for that dashboard, you will see URL parameters, such as

form.XXX

where XXX is the token defined in the input. However, in your searches you ONLY use the token name XXX, not $form.XXX$.

So, when you are passing tokens between dashboards, you only need to name them "form.XXX" if the receiving dashboard has inputs, which is why you use "form." in the token name.

If your receiving dashboard does not have inputs, then you only need to pass the token itself (no "form.") in the URL, i.e. debut=$debut$

Regardless of whether you have an input in the second dashboard, you only use the token name in searches. 

So to pass the 4 tokens in your URL you would need to set

<a href="/app/spl_pub/bp?site=$form.site|u$&amp;debut=$debut$&amp;fin=$fin$&amp;debut_4w=$debut_4w$&amp;fin_4w=$fin_4w$"

and your searches will be

| search site="$site$" AND period>$debut$ AND period<$fin$

or something like that depending on what your "period" represents. However, as your periods are date related, I suspect you might even want your search time range to be set in the XML as

<earliest>$debut_4w$</earliest>
<latest>$fin_4w$</latest>
0 Karma

jip31
Motivator

not sure to understand everything but i think the solution is not too far

I summarize :

when I use this link in the first dash

 

<a href="/app/spl_pub_dashboard/bpe2?form.site=$form.site|u$&amp;form.period=$form.period$" 

 

I can retrieve the period choice in the second dropdown list of the second dash

I have also added this in every search of the second dashboard (like i said i never use earliest=$debut_4w$ latest=$fin_4w$ in the second dashboard)

 

earliest=$debut$ latest=$fin$

 

 when I run a search in the second dashboard, I can see that the period correspond well to the period selected in the first dashboard (it's not the case if I use what you propose 

debut=$debut$&amp;fin=$fin$&amp;debut_4w=$debut_4w$&amp;fin_4w=$fin_4w$"

Now, the last problem i have in the second dashboard is that all the searches tell me "waiting for input"

I have to select a new period time in the dropdown list of the second dashboard in order to run all the searches...

so how to do for that the period selected in the first dashboard apply to all searches of the second dashboard?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Please post here the complete details of the form inputs in both dashboard and the searches you are trying to use, i.e. all the <fieldset> elements of the inputs from dashboard 1 and 2 and the <query> section of the search you are using in the second dashboard.

Please post it using the </> code button, rather than posting images.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @jip31,

Since your period input is not time, you cannot use the earliest and latest. You should pass this token same as site token.

Please test below;

<form>
  <label>TEST</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="period">
      <label>Période</label>
      <choice value="1654466400.0">Lundi 6 Juin 2022</choice>
      <choice value="1655071200.0">Lundi 13 Juin 2022</choice>
      <choice value="1655676000.0">Lundi 20 Juin 2022</choice>
      <choice value="1656280800.0">Lundi 27 Juin 2022</choice>
      <change>
        <eval token="debut">period</eval>
        <eval token="fin">debut+432000</eval>
        <eval token="debut_4w">relative_time(debut,"-4w")</eval>
        <eval token="fin_4w">relative_time(debut,"-0w")</eval>
      </change>
      <default>1655071200.0</default>
      <initialValue>1655071200.0</initialValue>
    </input>
    <input type="dropdown" token="site" searchWhenChanged="true">
      <label>Espace </label>
      <fieldForLabel>site</fieldForLabel>
      <fieldForValue>site</fieldForValue>
      <search>
        <query>`index_mes` 
| dedup site 
| table site 
| sort + site</query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">*</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
       <a href="/app/spl_pub/bpe?form.site=$form.site|u$&amp;form.period=$form.period$" target="_blank">Cliquez ici</a>

    </html>
    </panel>
  </row>
</form>
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

jip31
Motivator

Hi Scellilok

I ave already done this but it doesnt works....

Here is what I have in the URL

form.period=1655676000.0&form.date.earliest=1654466400&form.date.latest=1654898400

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...