I'm working on making an interactive dashboard, and I'm not sure how to do something...
My dashboard shows a pie chart of the top servers where errors are occurring. Next to it, a statistics table shows from what file source the top errors are coming from.
What I'm trying to figure out is how I would be able to click on a file source in the statistics table, and then change the pie chart to show only the servers that have errors matching with that clicked source.
Currently, I have it set up as errorSource=* for my pie chart, but that doesn't allow for token change. It would make sense to me to initialize something like $errorSourceToken=*$, but I don't know how I would initialize that without some kind of input like a radio button select or something (which I don't want to appear).
Let me know if you know of any solutions. Thanks so much!
-Logan
Well, I quickly found a solution to my own question. For anyone else who may have this problem...
It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up.
< form>
-----< label>My dashboard name< /label>
-----< init>
----------< set token="errorSourceToken">*< /set>
-----< /init>
< /form>
After setting that in the XML, I was able to edit the drilldown through the UI
To generate a token without a panel, you can use a base_search
and then an eval token
in the change
section. Also, you can just hard-code non-search-results based tokens at the top of your XML like this:
<init>
<!-->For some reason, in drilldown URLs, $APP$, just DOES NOT WORK!<-->
<!-->It ought to be that setting 'env_app' to a value of '$APP$' works, but it does NOT!<-->
<set token="env_app">MyHardCodedAppNameHere</set>
</init>
Well, I quickly found a solution to my own question. For anyone else who may have this problem...
It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up.
< form>
-----< label>My dashboard name< /label>
-----< init>
----------< set token="errorSourceToken">*< /set>
-----< /init>
< /form>
After setting that in the XML, I was able to edit the drilldown through the UI
@logankinman99 that can certainly be down using the contextual drilldown approach
You will have to set a token based on the clicked value. Examples below
Hope that helps.
https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/ContextualDrilldown
https://answers.splunk.com/answers/405291/how-to-change-the-search-based-on-a-clicked-table.html