Splunk IT Service Intelligence

How to create Drilldown between two ITSI Entity Dashboards?

wolfgangs
Engager

I am having trouble to create propper drilldown action between two Custom ITSI Entity Dashboards. They both work fine, when called by clicking the Entity Name in the Service Analyzer.

The two Entity Dashboards show data from two custom entity types with some relation to each other. I want to create a navigation between the two Dashboards.

I did create a normal drilldown action to call the related Dashboard. This works somehow, but the Token is not handled correctly.

for example I defined Token Parameters:
host = $click.value2$ and in the target dashboard I see
|search host=$click.value2$
instead of the real value that should have been handed over in the token.

When I use the Dashboards outside of ITSI, the drilldown action works fine.

Looks to me that in ITSI some scripts are used and the handover is not directly to the other Entity Dashboard, but somehow through the Entity (_key) and the defined entity type.

Great if somebody could shed some insights on that!

Labels (1)
0 Karma

datadevops
Path Finder

Hi there,

It seems the issue lies in token handling within ITSI scripts,
causing values to get replaced by entity keys/types instead of actual values. Here's what you can try:

  1. Double-check token names: Ensure token names in both dashboards match exactly. Typo? Case sensitivity? Fix them!
  2. Inspect ITSI scripts: If comfortable, take a peek at the ITSI scripts involved. Look for token handling logic and potential overrides.
  3. Consider alternative drilldown: Explore using "open in new tab" or custom links instead of the built-in drilldown, bypassing ITSI scripts.
  4. Seek ITSI community help: The ITSI community forum is a great resource for specific configuration advice and workarounds.

Remember, sometimes it's not about reinventing the wheel, but finding the right community to help navigate its quirks. Good luck!

~ If the reply helps, a Karma upvote would be appreciated

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...