Splunk Search

Simple XML - Token inside eval if

dojiepreji
Path Finder

Hello,

I have an eval if condition in my dashboard for my drilldown:

<eval token="query">if('category'=="Total",  "search ageGroup=*", where ageGroup='group_token')</eval>

I pass this line of search to a query on another dashboard. If the user clicks on 'Total' on the table, it will search everything for all age groups. If the user clicks on a particular age group, it will need to search the ageGroup in $group_token$.

This isn't working fine. How do I pass group_token to the search string to the other dashboard?

0 Karma

woodcock
Esteemed Legend

Don't do it this way. Assuming that your table events have a field called ageGroup, create a field called _group_token by adding this to the end of your existing search: | eval _group_token = coalesce(ageGroup, "*") (assuming that your Total field does not have a value for ageGroup). Then use standard drilldown with ... ageGroup = $click._group_token. Check out the Dashboard Examples app for drilldown details.

0 Karma

wmyersas
Builder

If I understand you correctly, you're trying to pass the value of a token on dashboardA as a GET argument in the URL string of dashboardB, correct?

If so, edit the drilldown targets like this:

drilldown editor screenshot

Of course, this presumes dashboardB can do something with URL parameters 🙂

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...