Splunk ITSI

How to create Drilldown between two ITSI Entity Dashboards?

wolfgangs
Engager

I am having trouble to create propper drilldown action between two Custom ITSI Entity Dashboards. They both work fine, when called by clicking the Entity Name in the Service Analyzer.

The two Entity Dashboards show data from two custom entity types with some relation to each other. I want to create a navigation between the two Dashboards.

I did create a normal drilldown action to call the related Dashboard. This works somehow, but the Token is not handled correctly.

for example I defined Token Parameters:
host = $click.value2$ and in the target dashboard I see
|search host=$click.value2$
instead of the real value that should have been handed over in the token.

When I use the Dashboards outside of ITSI, the drilldown action works fine.

Looks to me that in ITSI some scripts are used and the handover is not directly to the other Entity Dashboard, but somehow through the Entity (_key) and the defined entity type.

Great if somebody could shed some insights on that!

Labels (1)
0 Karma

datadevops
Path Finder

Hi there,

It seems the issue lies in token handling within ITSI scripts,
causing values to get replaced by entity keys/types instead of actual values. Here's what you can try:

  1. Double-check token names: Ensure token names in both dashboards match exactly. Typo? Case sensitivity? Fix them!
  2. Inspect ITSI scripts: If comfortable, take a peek at the ITSI scripts involved. Look for token handling logic and potential overrides.
  3. Consider alternative drilldown: Explore using "open in new tab" or custom links instead of the built-in drilldown, bypassing ITSI scripts.
  4. Seek ITSI community help: The ITSI community forum is a great resource for specific configuration advice and workarounds.

Remember, sometimes it's not about reinventing the wheel, but finding the right community to help navigate its quirks. Good luck!

~ If the reply helps, a Karma upvote would be appreciated

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...