Splunk Search

Populating dashboard panel with data from drilldown or multiselect token

Explorer

In my dashboard, I have the user select a server and then a line chart displays of application crashes on the selected server. I also want a drilldown set up so that if the user clicks a server from another table on the dashboard, the line chart adds data from the drilldown server. However when I try to set this up, the line chart will only populate if both the multiselect input and the drilldown are selected. How do I fix this so that data will load if no drilldown is selected?

<label>Host</label>
      <choice value="*">All</choice>
      <default>*</default>
      <delimiter>","</delimiter>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search>
        <query>index=*|stats count by host</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="time">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>


    <panel>
      <chart>
        <search>
          <query>index=* host IN ($host$) OR host="$hostclick$"|timechart count(EventCode) by host</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>


    <panel>
      <table>
        <title>Top 20 Hosts</title>
        <search>
          <query>index=*|top host limit=20</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="hostclick">$click.value$</set>
        </drilldown>
      </table>
    </panel>
0 Karma
1 Solution

SplunkTrust
SplunkTrust

@TylerJVitale ,

Add an init element to your dashboard to set a dummy token on load

  <init>
    <set token="hostclick">dummy</set>
  </init>

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@TylerJVitale ,

Add an init element to your dashboard to set a dummy token on load

  <init>
    <set token="hostclick">dummy</set>
  </init>

View solution in original post

0 Karma

Explorer

Sorry the xml formatting isn't right. I'm not sure how to fix that.

0 Karma