Solved: splitting and sending the value from drill down to...

vikashperiwal · ‎01-22-2021

HI ,

I am trying to send values from one panel to another dashboard using drill down , is it possible to split the value and then send....

I have field name

"host: Running" ,

"service: Running" ,

"URL: Running" in main dashboard, these are generated fields, when i click on any field it should trigger drill down

In my drilldown dashboard I have a dropdown and want only the "host" from main dashboard,

Drill Down Dropdown

service: Running

Expected Dropdown

service

Basically want to split the value in main dashboard

My drilldown
form.token=$click.name2$

renjith_nair · ‎01-24-2021

Try this run anywhere example and can use in your drill down

<dashboard>
  <label>DrillDown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults|eval "host: Running" ="hostnames"
|eval "service: Running"="service name"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <eval token="tokenName">mvindex(split($click.name2$,":"),0)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <h2>Token Value : $tokenName$</h2>
      </html>
    </panel>
  </row>
</dashboard>

Happy Splunking!

View solution in original post

renjith_nair · ‎01-24-2021

Try this run anywhere example and can use in your drill down

<dashboard>
  <label>DrillDown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults|eval "host: Running" ="hostnames"
|eval "service: Running"="service name"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <eval token="tokenName">mvindex(split($click.name2$,":"),0)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <h2>Token Value : $tokenName$</h2>
      </html>
    </panel>
  </row>
</dashboard>

Happy Splunking!

vikashperiwal · ‎01-26-2021

Thanks for this approach....although I had to do drilldown to another dashboard...but the split logic used in drilldown was the need for me...thanks a lot

splitting and sending the value from drill down to other dashboard

other

Streamline Data Ingestion With Deployment Server Essentials

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

Introduction to Splunk AI