Splunk Search

Simple XML - Token inside eval if

dojiepreji
Path Finder

Hello,

I have an eval if condition in my dashboard for my drilldown:

<eval token="query">if('category'=="Total",  "search ageGroup=*", where ageGroup='group_token')</eval>

I pass this line of search to a query on another dashboard. If the user clicks on 'Total' on the table, it will search everything for all age groups. If the user clicks on a particular age group, it will need to search the ageGroup in $group_token$.

This isn't working fine. How do I pass group_token to the search string to the other dashboard?

0 Karma

woodcock
Esteemed Legend

Don't do it this way. Assuming that your table events have a field called ageGroup, create a field called _group_token by adding this to the end of your existing search: | eval _group_token = coalesce(ageGroup, "*") (assuming that your Total field does not have a value for ageGroup). Then use standard drilldown with ... ageGroup = $click._group_token. Check out the Dashboard Examples app for drilldown details.

0 Karma

wmyersas
Builder

If I understand you correctly, you're trying to pass the value of a token on dashboardA as a GET argument in the URL string of dashboardB, correct?

If so, edit the drilldown targets like this:

drilldown editor screenshot

Of course, this presumes dashboardB can do something with URL parameters 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...