Splunk Search

update eval token with first row of a dashboard table

nabeel652
Builder

I have two tables in a dashboard, The top one lists all the WAN links and the bottom one shows the detailed link utilisation over time when any device link in the top table is clicked.

I want the bottom table to update automatically with the first device (whatever in the top table is) using eval token so that it doesn't come up with "Search is waiting for input" message. The links in the upper table keep on changing so I cannot hard code the token in the bottom table to show a specific link every time the dashboard loads.

In short: On first page load the table at the bottom to show records related to whatever the wan-link is in the first row of the table at the top. Once dashboard has loaded it should be able to show upon clicking on any link in the top table.

Tags (3)
0 Karma
1 Solution

nabeel652
Builder

Well, done that the dirty way:

Created a dropdown and set its <selectFirstChoice>true</selectFirstChoice>

Then ran the same query that runs in the top table and the token for dropdown set with the first (top most) value. That token name is the same as the drilldown token in top table.

then set the input to hidden by depends="$somedummyvar$".

All good 🙂

View solution in original post

nabeel652
Builder

Well, done that the dirty way:

Created a dropdown and set its <selectFirstChoice>true</selectFirstChoice>

Then ran the same query that runs in the top table and the token for dropdown set with the first (top most) value. That token name is the same as the drilldown token in top table.

then set the input to hidden by depends="$somedummyvar$".

All good 🙂

paramagurukarth
Builder

Adding to this.. Instead of running the same search twice.. give an ID for that search and use that as the base search for you dropdown and table... so that the first result in the table and the dropdown(i.e, token) will be same in all scenarios

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...