Solved: Re: How to unset a token in drilldown based on spe...

rahul_n · ‎05-09-2021

Hi.

I am trying to edit a source code of a splunk panel such that, the token should only when the user clicks on a particular column (Not a particular value).

For example:

lets consider the below table.

Column1	Column2	Column3	Column4	Column5	Column6	Column7
value1	value2	value3	value4	value5	value6	value7
value11	value22	value33	value44	value55	value66	value77

I want to make changes such that, the token should work only when the user clicks any value in Column1 and Column2 (It can be value1 or value11 or value2 or value22 ). The token should not work when the user clicks on any value from other columns.

The opened new panel based on token should disappear when user clicks on any value from columns other than column1 and column2.

The source code which I have :

<row>
    <panel>
      <table>
        <title>Stats by user(Click on a value for further info)</title>
        <search>
          <query> SOME BUSINESS SPLUNK QUERY)</query>
          <earliest>$startTime.earliest$</earliest>
          <latest>$startTime.latest$</latest>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>'<option name="count">20</option>
        <option name="dataOverlayMode">heatmap</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <drilldown>
          <condition>
            <set token="value">$click.value2$</set>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$value$">
    <panel>
      <title>Usage of $value$</title>
      <chart>
        <search>
          <query> ANOTHER SPLUNK QUERY</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <unset token="value"></unset>
        </drilldown>
      </chart>
    </panel>
  </row>

Please help me to add a condition to unset token based on column.

Any help is greatly appreciated.

Thanks in Advance.

renjith_nair · ‎05-09-2021

Try below run anywhere example

Token is set to the clicked value for column 1 or column 2 and unset for other columns.

<dashboard>
  <label>Conditional Token</label>
  <row>
    <panel>
      <html>
        <h2>
          Token Value : <font color="red">$token_value$</font>
        </h2>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults count=5|streamstats count| eval column1=count."_column1", column2=count."_column2", column3=count."_column3", column4=count."_column4"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="column1">
            <set token="token_value">$click.value2$</set>
          </condition>
          <condition field="column2">
            <set token="token_value">$click.value2$</set>
          </condition>
          <condition>
            <unset token="token_value">$click.value2$</unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎05-09-2021

Try below run anywhere example

Token is set to the clicked value for column 1 or column 2 and unset for other columns.

<dashboard>
  <label>Conditional Token</label>
  <row>
    <panel>
      <html>
        <h2>
          Token Value : <font color="red">$token_value$</font>
        </h2>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults count=5|streamstats count| eval column1=count."_column1", column2=count."_column2", column3=count."_column3", column4=count."_column4"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="column1">
            <set token="token_value">$click.value2$</set>
          </condition>
          <condition field="column2">
            <set token="token_value">$click.value2$</set>
          </condition>
          <condition>
            <unset token="token_value">$click.value2$</unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

---
What goes around comes around. If it helps, hit it with Karma 🙂

rahul_n · ‎05-15-2021

Thanks @renjith_nair for the solution.

How to unset a token in drilldown based on specific column?

chart

fields

lookup

metadata

stats

table

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

May 2026 Splunk Expert Sessions: Security & Observability

Network to App: Observability Unlocked [May & June Series]

Join the Conversation

How to unset a token in drilldown based on specific column?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.