Splunk Search

update eval token with first row of a dashboard table

nabeel652
Builder

I have two tables in a dashboard, The top one lists all the WAN links and the bottom one shows the detailed link utilisation over time when any device link in the top table is clicked.

I want the bottom table to update automatically with the first device (whatever in the top table is) using eval token so that it doesn't come up with "Search is waiting for input" message. The links in the upper table keep on changing so I cannot hard code the token in the bottom table to show a specific link every time the dashboard loads.

In short: On first page load the table at the bottom to show records related to whatever the wan-link is in the first row of the table at the top. Once dashboard has loaded it should be able to show upon clicking on any link in the top table.

Tags (3)
0 Karma
1 Solution

nabeel652
Builder

Well, done that the dirty way:

Created a dropdown and set its <selectFirstChoice>true</selectFirstChoice>

Then ran the same query that runs in the top table and the token for dropdown set with the first (top most) value. That token name is the same as the drilldown token in top table.

then set the input to hidden by depends="$somedummyvar$".

All good 🙂

View solution in original post

nabeel652
Builder

Well, done that the dirty way:

Created a dropdown and set its <selectFirstChoice>true</selectFirstChoice>

Then ran the same query that runs in the top table and the token for dropdown set with the first (top most) value. That token name is the same as the drilldown token in top table.

then set the input to hidden by depends="$somedummyvar$".

All good 🙂

paramagurukarth
Builder

Adding to this.. Instead of running the same search twice.. give an ID for that search and use that as the base search for you dropdown and table... so that the first result in the table and the dropdown(i.e, token) will be same in all scenarios

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...