Splunk IT Service Intelligence

How to create Drilldown between two ITSI Entity Dashboards?

wolfgangs
Engager

I am having trouble to create propper drilldown action between two Custom ITSI Entity Dashboards. They both work fine, when called by clicking the Entity Name in the Service Analyzer.

The two Entity Dashboards show data from two custom entity types with some relation to each other. I want to create a navigation between the two Dashboards.

I did create a normal drilldown action to call the related Dashboard. This works somehow, but the Token is not handled correctly.

for example I defined Token Parameters:
host = $click.value2$ and in the target dashboard I see
|search host=$click.value2$
instead of the real value that should have been handed over in the token.

When I use the Dashboards outside of ITSI, the drilldown action works fine.

Looks to me that in ITSI some scripts are used and the handover is not directly to the other Entity Dashboard, but somehow through the Entity (_key) and the defined entity type.

Great if somebody could shed some insights on that!

Labels (1)
0 Karma

datadevops
Path Finder

Hi there,

It seems the issue lies in token handling within ITSI scripts,
causing values to get replaced by entity keys/types instead of actual values. Here's what you can try:

  1. Double-check token names: Ensure token names in both dashboards match exactly. Typo? Case sensitivity? Fix them!
  2. Inspect ITSI scripts: If comfortable, take a peek at the ITSI scripts involved. Look for token handling logic and potential overrides.
  3. Consider alternative drilldown: Explore using "open in new tab" or custom links instead of the built-in drilldown, bypassing ITSI scripts.
  4. Seek ITSI community help: The ITSI community forum is a great resource for specific configuration advice and workarounds.

Remember, sometimes it's not about reinventing the wheel, but finding the right community to help navigate its quirks. Good luck!

~ If the reply helps, a Karma upvote would be appreciated

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...