Splunk Search

update eval token with first row of a dashboard table

Builder

I have two tables in a dashboard, The top one lists all the WAN links and the bottom one shows the detailed link utilisation over time when any device link in the top table is clicked.

I want the bottom table to update automatically with the first device (whatever in the top table is) using eval token so that it doesn't come up with "Search is waiting for input" message. The links in the upper table keep on changing so I cannot hard code the token in the bottom table to show a specific link every time the dashboard loads.

In short: On first page load the table at the bottom to show records related to whatever the wan-link is in the first row of the table at the top. Once dashboard has loaded it should be able to show upon clicking on any link in the top table.

Tags (3)
0 Karma
1 Solution

Builder

Well, done that the dirty way:

Created a dropdown and set its <selectFirstChoice>true</selectFirstChoice>

Then ran the same query that runs in the top table and the token for dropdown set with the first (top most) value. That token name is the same as the drilldown token in top table.

then set the input to hidden by depends="$somedummyvar$".

All good 🙂

View solution in original post

Builder

Well, done that the dirty way:

Created a dropdown and set its <selectFirstChoice>true</selectFirstChoice>

Then ran the same query that runs in the top table and the token for dropdown set with the first (top most) value. That token name is the same as the drilldown token in top table.

then set the input to hidden by depends="$somedummyvar$".

All good 🙂

View solution in original post

Adding to this.. Instead of running the same search twice.. give an ID for that search and use that as the base search for you dropdown and table... so that the first result in the table and the dropdown(i.e, token) will be same in all scenarios