Splunk Search

splitting and sending the value from drill down to other dashboard

vikashperiwal
Path Finder

HI ,

 

I am trying to send values from one panel to another dashboard using drill down , is it possible to split the value and then send....

I  have field name

"host: Running" ,

"service: Running"  ,

"URL: Running" in main dashboard, these are generated fields, when i click on any field it should trigger drill down

In my drilldown dashboard I have a dropdown and want only the "host"  from main dashboard, 

Drill Down Dropdown          

service: Running

 Expected Dropdown

service

Basically want to split the value in main dashboard

My drilldown
form.token=$click.name2$

Labels (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try this run anywhere example and can use in your drill down

<dashboard>
  <label>DrillDown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults|eval "host: Running" ="hostnames"
|eval "service: Running"="service name"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <eval token="tokenName">mvindex(split($click.name2$,":"),0)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <h2>Token Value : $tokenName$</h2>
      </html>
    </panel>
  </row>
</dashboard>

 

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Try this run anywhere example and can use in your drill down

<dashboard>
  <label>DrillDown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults|eval "host: Running" ="hostnames"
|eval "service: Running"="service name"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <eval token="tokenName">mvindex(split($click.name2$,":"),0)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <h2>Token Value : $tokenName$</h2>
      </html>
    </panel>
  </row>
</dashboard>

 

View solution in original post

vikashperiwal
Path Finder

Thanks for this approach....although I had to do drilldown to another dashboard...but the split logic used in drilldown was the need for me...thanks a lot

0 Karma