Splunk Search

Populating dashboard panel with data from drilldown or multiselect token

TylerJVitale
Explorer

In my dashboard, I have the user select a server and then a line chart displays of application crashes on the selected server. I also want a drilldown set up so that if the user clicks a server from another table on the dashboard, the line chart adds data from the drilldown server. However when I try to set this up, the line chart will only populate if both the multiselect input and the drilldown are selected. How do I fix this so that data will load if no drilldown is selected?

<label>Host</label>
      <choice value="*">All</choice>
      <default>*</default>
      <delimiter>","</delimiter>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search>
        <query>index=*|stats count by host</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="time">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>


    <panel>
      <chart>
        <search>
          <query>index=* host IN ($host$) OR host="$hostclick$"|timechart count(EventCode) by host</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>


    <panel>
      <table>
        <title>Top 20 Hosts</title>
        <search>
          <query>index=*|top host limit=20</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="hostclick">$click.value$</set>
        </drilldown>
      </table>
    </panel>
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@TylerJVitale ,

Add an init element to your dashboard to set a dummy token on load

  <init>
    <set token="hostclick">dummy</set>
  </init>
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@TylerJVitale ,

Add an init element to your dashboard to set a dummy token on load

  <init>
    <set token="hostclick">dummy</set>
  </init>
Happy Splunking!
0 Karma

TylerJVitale
Explorer

Sorry the xml formatting isn't right. I'm not sure how to fix that.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...