Splunk ITSI

How to create Drilldown between two ITSI Entity Dashboards?

wolfgangs
Engager

I am having trouble to create propper drilldown action between two Custom ITSI Entity Dashboards. They both work fine, when called by clicking the Entity Name in the Service Analyzer.

The two Entity Dashboards show data from two custom entity types with some relation to each other. I want to create a navigation between the two Dashboards.

I did create a normal drilldown action to call the related Dashboard. This works somehow, but the Token is not handled correctly.

for example I defined Token Parameters:
host = $click.value2$ and in the target dashboard I see
|search host=$click.value2$
instead of the real value that should have been handed over in the token.

When I use the Dashboards outside of ITSI, the drilldown action works fine.

Looks to me that in ITSI some scripts are used and the handover is not directly to the other Entity Dashboard, but somehow through the Entity (_key) and the defined entity type.

Great if somebody could shed some insights on that!

Labels (1)
0 Karma

datadevops
Path Finder

Hi there,

It seems the issue lies in token handling within ITSI scripts,
causing values to get replaced by entity keys/types instead of actual values. Here's what you can try:

  1. Double-check token names: Ensure token names in both dashboards match exactly. Typo? Case sensitivity? Fix them!
  2. Inspect ITSI scripts: If comfortable, take a peek at the ITSI scripts involved. Look for token handling logic and potential overrides.
  3. Consider alternative drilldown: Explore using "open in new tab" or custom links instead of the built-in drilldown, bypassing ITSI scripts.
  4. Seek ITSI community help: The ITSI community forum is a great resource for specific configuration advice and workarounds.

Remember, sometimes it's not about reinventing the wheel, but finding the right community to help navigate its quirks. Good luck!

~ If the reply helps, a Karma upvote would be appreciated

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...