@gcusello  Please find the below code. I was successfully able to generate the URL in my template but the requestId is still not being populated. But org id and instance and other ids are getting populated. Why is $row.requestId$ not being populated ? <row> <panel> <title>Statistics by Entrypoint</title> <table> <title>Please select Rows having high CPU Time</title> <search> <query>$instance_select$ CASE($organizationId$) earliest=$earliest$ latest=$latest$ `logRecordType(axapx)` [search $instance_select$ CASE($organizationId$) earliest=$earliest$ latest=$latest$ `logRecordType(gslog)` "CPU_ENFORCED"| stats count by requestId | fields requestId | format ] | stats count by entryPoint, userId | sort -count | streamstats count as Sr.No. | fields Sr.No., entryPoint, userId, count </query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <format type="color" field="errorThresholdCount"> <colorPalette type="list">[#FFFFFF,#53A051,#DC4E41]</colorPalette> <scale type="threshold">0,1</scale> </format> <drilldown target="_blank"> <set token="eptok"> <![CDATA[$row.entryPoint$]]> </set> <set token="drilldown_display">block</set> <eval token="earliest_str">$row.earliest_str$</eval> <eval token="latest_str">$row.latest_str$</eval> <eval token="earliest_str">$row.earliest$</eval> <eval token="tempEarliest">$earliest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="earliestUTC">if(isnull($earliestUTC$), strftime($tempEarliest$,"%m/%d/%y %H:%M:%S") , $earliestUTC$)</eval> <eval token="latest_str">$row.latest$</eval> <eval token="tempLatest">$latest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="latestUTC">if(isnull($latestUTC$), strftime($tempLatest$,"%m/%d/%y %H:%M:%S"), $latestUTC$)</eval> <set token="SeverityTok">$severity$</set> <set token="eptok">$row.entryPoint$</set> <set token="epUserId">$row.userId$</set> <set token="Count">$row.count$</set> <set token="errorThresholdCount">$row.errorThresholdCount$</set> <set token="epAvgTime">$row.averageRunTime$</set> <set token="epMaxTime">$row.maxRunTime$</set> <set token="epAvgcpuTime">$row.averageCpuTime$</set> <set token="epMaxcpuTime">$row.maxCpuTime$</set> <set token="epAvgDbtime">$row.averageDbTotalTime$</set> <set token="epMaxDbtime">$row.maxDbTotalTime$</set> <eval token="entrypoint_detail">if(isnull($entrypoint_detail$)," [".$row.Sr.No.$."] EntryPoint : ".$row.entryPoint$." UserId: ".$row.userId$." Count : ".$row.count$." ",$entrypoint_detail$." [".$row.Sr.No.$."] EntryPoint : ".$row.entryPoint$." UserId: ".$row.userId$." Count : ".$row.count$." ")</eval> <eval token="perfDashUrl"> if(isnull($perfDashUrl$)," . ",$perfDashUrl$." Performance Dashboard URL : ".$row.dashboard_url$." ") </eval> </drilldown> </table> </panel> </row> <row> <panel depends="$drilldown_display$"> <table> <title>Top RequestIds for $eptok$</title> <search> <query>$instance_select$ organizationId=CASE($organizationId$) earliest=$earliest$ latest=$latest$ sourcetype=CASE(applog*:axapx) [search $instance_select$ organizationId=CASE($organizationId$) earliest=$earliest$ latest=$latest$ sourcetype=CASE(applog*:gslog) "CPU_ENFORCED"| stats count by requestId | fields requestId | format ] entryPoint="$eptok$" | eval dashboard_url="https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$" | table requestId runTime dashboard_url | fields requestId runTime <!-- &amp;form.requestId=$reqtok$ --> | sort -runTime</query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <drilldown> <set token="drilldown_display1">block</set> <set token="reqtok">$row.requestId$</set> <set token="abc">$row.requestId$</set> <eval token="perfDashUrl">if(isnull($perfDashUrl$)," Performance Dashboard URL : https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$row.requestId$ ",$perfDashUrl$." Performance Dashboard URL : https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$row.requestId$ ")</eval> <link target="_blank">https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$reqtok$</link> </drilldown> </table> </panel> </row> <row> <panel depends="$drilldown_display$"> <!-- Customer suggestions --> <html> <h1 class="SectionHeader">INTERNAL COMMENTS </h1> <div style="float:left; width:calc(95% - 60px);" class="pageInfo"> <pre> ===========INTERNAL============== <b>Dashboard URL : </b> https://splunk-web.com/en-US/app/publicSharing/timeout_exception_v1?earliest=$earliest$&amp;latest=$latest$&amp;form.instance=$instance$&amp;form.organizationId=$organizationId$&amp;form.userId=*&amp;form.entityType=*&amp;form.verb=*&amp;form.span=1h&amp;severity=$severity$ <b>Performance Dashboard url : </b> $perfDashUrl$ ===========INTERNAL============== </pre> </div> </html> </panel> </row>  Current OutPut is : ===========INTERNAL============== Performance Dashboard URL : https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=UP55&form.orgId=00T63518gtwie44&form.requestId=$row.requestId$ Performance Dashboard URL : https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=UP55&form.orgId=00T63518gtwie44&form.requestId=$row.requestId$ ===========INTERNAL==============?  Please help me with requestId=$row.requestId$ 😞  ... View more

@gcusello  The ideal output should look like this  ===========INTERNAL============== Drilldown URL : https://splunk-web.monitoring.com/en-US/app/publicSharing/Dashboard_second?form.instance=am55&amp;form.orgId=00T76000000RTY&amp;form.requestId=TID:d56153hk78600 https://splunk-web.monitoring.com/en-US/app/publicSharing/Dashboard_second?form.instance=am55&amp;form.orgId=00T76000000RTY&amp;form.requestId=TID:mt00952y3rt098 ===========INTERNAL==============   I made clicks on two rows and these two urls are populated with different requestID (check the URL ending part) ... View more

@gcusello  let me understand: you want to put the secondary dashboard URL in a token and pass it to another panel of the same dashboard, is it correct?   --------   YES, you are right. The intention here is to put the secondary dashboard URL in a token and pass it to another panel But I see that you have hardcoded the URL in the code. The URL keeps changing based on the row I click.  If you see below, the requestId is picked dynamically from the current row and stored in $reqtok$ . So I want all these URLs passed to HTML panel as I click each row.  https://splunk-web.monitoring.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$reqtok$   ... View more

@gcusello Any thoughts?  ... View more

@ITWhisperer any thoughts? ... View more

@gcusello   Could you please help 🙂  ... View more

@ITWhisperer  There is one flaw in the code. When we click on the row twice, it prints the data in the template without checking for duplicates.  I was thinking of storing the dashboard Id in a token and add a script in our HTML code to check for duplicates. But not sure if this approach is correct.  Any thoughts?  ... View more

@ITWhisperer  Any idea what should the approach be?    > I have a Gsheet with a unique id in the column A. If that matches my <uniqueId_tok> Token in the dashboard, an HTML panel can display the data present on column B of my G-sheet  Example :  Google sheet :  Column A           Column B 5227                    Monday 1256                    Tuesday 7690                    Wednesday   If <uniqueId_tok> = 5227 then my panel reads G-sheet and displays data in column B i.e Monday Hope my ASK is clear  ... View more

Hii @ITWhisperer  One simple refresh functionality that we need to add to the below HTML panel > As discussed, We append row data from the previous panel and store it in <customer_commet_report> token > Now I want to add a refresh button on this panel So that if the user clicks the wrong row, we can refresh this HTML panel using a refresh button just for this panel rather than refreshing the whole dashboard. > I tried using this code below in my HTML panel but i guess I'm missing something. Can you help ? Attempt to add refresh button in Panel :  <input type="link" token="refresh"> <label></label> <choice value="Yes">Refresh?</choice> <change> <condition value="Yes"> <unset token="customer_coment_report"></unset> </condition> </change> </input> HTML Panel Code <row depends="$drilldown_display$"> <panel> <!-- template with row data --> <html> <h1 class="SectionHeader">Case Updation Template</h1> <div style="float:left; width:calc(95% - 100px);" class="pageInfo"> <pre> Hi Team, We have received alert for dashboards. Please see below fro more details: Upon checking, we found below dashboards took high run time on an average: $customer_comment_report$ Please review the above mentioned operations at your end. Thanks, Splunk Team </pre> </div> </html> </panel> </row>   ... View more

@ITWhisperer  You are a legend. Well implemented the logic using nested if 👍 Just a quick question.  Can I store the results generated in our reports panel (reported and runTime) and display the table as it is in our HTML panel? Rather than accessing each row data and appending?   ... View more

@ITWhisperer  Here's an update. Tried to understand better what you said and implemented this.  > Appending $customer_comment_report$ to $customer_comment_da$  > displaying $customer_comment_da$ in HTML panel   <eval token="customer_comment_da">if(isnull($customer_comment_da$),"<!-- Code to display multiple rows data in template -->Dashboard ID : ".$row.dashboardId$." User ID : ".$row.userId$." Count : ".$row.count$." Average runTime : ".$row.averageRunTime$." ms Max runTime : ".$row.maxRunTime$." ms <br/> ".$customer_comment_report$." ",$customer_comment_da$." Dashboard ID : ".$row.dashboardId$." User ID : ".$row.userId$." Count : ".$row.count$." Average runTime : ".$row.averageRunTime$." ms Max runTime : ".$row.maxRunTime$." ms ".$customer_comment_report$." ")</eval>     If the above code is fine, then I feel we are almost there. just a couple of small challenges here... > The first output of $customer_comment_da$ displays $customer_comment_report$ component as null since as per programming flow, reports are yet to be generated in next step of code.   >  On clicking the 2nd and third dashboards,  the $customer_comment_report$ seems to store report ids from older dashboards as well. I guess we'll have to make the token null so that fresh report ids are populated for new dashboardId  ... View more

@ITWhisperer  Just tried what you suggested. And I am a bit confused if this is what you meant?    Customer_comment_da <eval token="customer_comment_da">if(isnull($customer_comment_da$),"<!-- Code to display multiple rows data in template -->Dashboard ID : ".$row.dashboardId$." User ID : ".$row.userId$." Count : ".$row.count$." Average runTime : ".$row.averageRunTime$." ms Max runTime : ".$row.maxRunTime$." ms ",$customer_comment_da$." Dashboard ID : ".$row.dashboardId$." User ID : ".$row.userId$." Count : ".$row.count$." Average runTime : ".$row.averageRunTime$." ms Max runTime : ".$row.maxRunTime$." ms ")</eval>   customer_comment_report <eval token="customer_comment_report">if(isnull($customer_comment_report$),"<!-- Code to display multiple rows data in template -->".$customer_comment_da$." <br/> Reports for the above dashboard consuming high runTime : ------------------------ Report ID runTime (ms) ------------------------ ".$row.reportId$." ".$row.runTime$." ",$customer_comment_da$." ".$row.reportId$." ".$row.runTime$." ") </eval>   ... View more

@ITWhisperer  I had the exact same thought and implemented the below code.    [1] Here I tokenized the elements I needed from Dashboard panel (dashTok, dashUserId,dashCount,dashAvgTime,dashMaxTime) and used them in $customer_comment_report$ ad it works fine giving below results.  But the issue with this approach is its good for one dashboard and its corresponding report. When i click on second dashboard, it doesnt append 2nd dashboard id, its count etc and its corresponding reports.        <!-- Row displaying 2 Panels : DashboardId & Report ID--> <row> <panel> <table> <title>Dashboard performance</title> <!-- Panel to display dashboard ID. Once we click on a dashboardID it shows required data in customer_comment_da --> <search> <query>$input_index$ `logRecordType(D,R)` earliest=$earliest$ latest=$latest$ | stats count, count(eval(runTime &gt; 2000)) as infoThresholdCount, count(eval(runTime * 1 &gt; 2000)) as warnThresholdCount, count(eval(runTime * 1 * 1 &gt; 5000)) as errorThresholdCount, avg(runTime) as averageRunTime, max(runTime) as maxRunTime, avg(cpuTime) as averageCpuTime, max(cpuTime) as maxCpuTime, avg(waitTime) as averageWaitTime, max(waitTime) as maxWaitTime by dashboardId, userId | eval averageRunTime = round(averageRunTime, 2) | sort -averageRunTime </query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <drilldown target="_blank"> <eval token="earliest_str">$row.earliest_str$</eval> <eval token="latest_str">$row.latest_str$</eval> <eval token="earliest_str">$row.earliest$</eval> <eval token="tempEarliest">$earliest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="earliestUTC">if(isnull($earliestUTC$), strftime($tempEarliest$,"%m/%d/%y %H:%M:%S") , $earliestUTC$)</eval> <eval token="latest_str">$row.latest$</eval> <eval token="tempLatest">$latest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="latestUTC">if(isnull($latestUTC$), strftime($tempLatest$,"%m/%d/%y %H:%M:%S"), $latestUTC$)</eval> <set token="dashTok">$row.dashboardId$</set> <!-- tokenize dashboard components from panel 1 --> <set token="dashUserId">$row.userId$</set> <set token="dashCount">$row.count$</set> <set token="dashAvgTime">$row.averageRunTime$</set> <set token="dashMaxTime">$row.maxRunTime$</set> <!-- End of tokenize dashboard components from panel 1 --> <!-- Code to display multiple rows data in template --> <eval token="customer_comment_da">if(isnull($customer_comment_da$),"Dashboard ID : ".$row.dashboardId$." User ID : ".$row.userId$." Count : ".$row.count$." Average runTime : ".$row.averageRunTime$." ms Max runTime : ".$row.maxRunTime$." ms ",$customer_comment_da$." Dashboard ID : ".$row.dashboardId$." User ID : ".$row.userId$." Count : ".$row.count$." Average runTime : ".$row.averageRunTime$." ms Max runTime : ".$row.maxRunTime$." ms ")</eval> <!-- End Code to display multiple rows data in template --> <!-- Panel that runs when we click on the dashboard id. We are using using $dashTok$ from above panel to run the below query --> <set token="drilldown_display">block</set> </drilldown> </table> </panel> <panel> <table> <title>Reports based on dashboard ID</title> <search> <query>$input_index$ `logRecordType(D,R)` earliest=$earliest$ latest=$latest$ dashboardId=$dashTok$ | table reportId runTime | sort -runTime</query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <option name="drilldown">row</option> <drilldown target="_blank"> <eval token="earliest_str">$row.earliest_str$</eval> <eval token="latest_str">$row.latest_str$</eval> <eval token="earliest_str">$row.earliest$</eval> <eval token="tempEarliest">$earliest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="earliestUTC">if(isnull($earliestUTC$), strftime($tempEarliest$,"%m/%d/%y %H:%M:%S") , $earliestUTC$)</eval> <eval token="latest_str">$row.latest$</eval> <eval token="tempLatest">$latest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="latestUTC">if(isnull($latestUTC$), strftime($tempLatest$,"%m/%d/%y %H:%M:%S"), $latestUTC$)</eval> <!-- Storing top reportid using customer_comment_report token and displaying in the template --> <eval token="customer_comment_report">if(isnull($customer_comment_report$),"<!-- Code to display multiple rows data in template -->DashboardId : ".$dashTok$." Count : ".$dashCount$." User ID : ".$dashUserId$." Avg runTime : ".$dashAvgTime$." Max runTime : ".$dashMaxTime$." <br/> Reports for the above dashboard consuming high runTime : ------------------------ Report ID runTime (ms) ------------------------ ".$row.reportId$." ".$row.runTime$." ",$customer_comment_report$." ".$row.reportId$." ".$row.runTime$." ") </eval> <!-- End Code to display multiple rows data in template --> <set token="drilldown_display">block</set> </drilldown> </table> </panel> </row> <!-- below block shows template extracted from above queries --> <row depends="$drilldown_display$"> <panel> <!-- template with row data --> <html> <h1 class="SectionHeader">Case Updation Template</h1> <div style="float:left; width:calc(95% - 100px);" class="pageInfo"> <pre> Hi Team, We have received alert for dashboards. Please see below fro more details: Upon checking, we found below dashboards took high run time on an average: $customer_comment_report$ Please review the above mentioned operations at your end. Thanks, Splunk Team </pre> </div> </html> </panel> </row>     [2] Coming to your approach you suggested, of bringing report ids from 2nd panel to customer_comment_da in 1st panel. How do i tokenize the top 3 or 4 rows of report id and append it with customer_comment_da token? Ideal output expected: [1] DashboardId : 01T5b0000004eST Count : 9 User ID : 00536532002Z2ov Avg runTime : 95860.33 ms Max runTime : 602874 ms Reports for the above dashboard consuming high runTime : ------------------------ Report ID runTime (ms) ------------------------ 00O5b0000099BUT 602874 00O5b0000099BLM 77054 00O5b0000099BTC 76588 00O5b0000099GUH 30119 [2] DashboardId : 01P5b0000004eST Count : 6 User ID : 00536500002Z2kl Avg runTime : 55720 ms Max runTime : 501324 ms Reports for the above dashboard consuming high runTime : ------------------------ Report ID runTime (ms) ------------------------ 00O5b0000066BUT 80052 00O5b0000066BLM 44520 ... View more

Hi @ITWhisperer ,  Please find the XML code below:  <form> <label>Support - Dashboard performance</label> <description>Support - Dashboard performance with reports</description> <fieldset submitButton="true" autoRun="true"> <input token="input_index"> <!-- input1 --> <default>ENTER_AN_INDEX</default> <input token="userId"> <!-- input2 --> <default>*</default> </input> <input type="text" token="entityType" searchWhenChanged="true"> <!-- input3 --> <label>entityType</label> <default>*</default> <initialValue>*</initialValue> </input> <input type="text" token="verb" searchWhenChanged="true"> <!-- input4 --> <label>verb</label> <default>*</default> <initialValue>*</initialValue> </input> <input type="time" searchWhenChanged="false"> <!-- input5 --> <default> <earliestTime>-24h@h</earliestTime> <latestTime>now</latestTime> </default> </input> <input type="text" token="span" searchWhenChanged="true"> <!-- input6 --> <label>Timechart Span</label> <default>1h</default> </input> </fieldset> <!-- Row displaying 2 Panels : DashboardId & Report ID--> <row> <panel> <table> <title>Dashboard performance</title> <!-- Panel to display dashboard ID. Once we click on a dashboardID it shows required data in customer_comment_da --> <search> <query>$input_index$ `logRecordType(D,R)` earliest=$earliest$ latest=$latest$ | stats count, count(eval(runTime &gt; 2000)) as infoThresholdCount, count(eval(runTime * 1 &gt; 2000)) as warnThresholdCount, count(eval(runTime * 1 * 1 &gt; 5000)) as errorThresholdCount, avg(runTime) as averageRunTime, max(runTime) as maxRunTime, avg(cpuTime) as averageCpuTime, max(cpuTime) as maxCpuTime, avg(waitTime) as averageWaitTime, max(waitTime) as maxWaitTime by dashboardId, userId | eval averageRunTime = round(averageRunTime, 2) | sort -averageRunTime </query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <drilldown target="_blank"> <eval token="earliest_str">$row.earliest_str$</eval> <eval token="latest_str">$row.latest_str$</eval> <eval token="earliest_str">$row.earliest$</eval> <eval token="tempEarliest">$earliest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="earliestUTC">if(isnull($earliestUTC$), strftime($tempEarliest$,"%m/%d/%y %H:%M:%S") , $earliestUTC$)</eval> <eval token="latest_str">$row.latest$</eval> <eval token="tempLatest">$latest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="latestUTC">if(isnull($latestUTC$), strftime($tempLatest$,"%m/%d/%y %H:%M:%S"), $latestUTC$)</eval> <set token="dashTok">$row.dashboardId$</set> <!-- Code to display multiple rows data in template --> <eval token="customer_comment_da">if(isnull($customer_comment_da$),"Dashboard ID : ".$row.dashboardId$." User ID : ".$row.userId$." Count : ".$row.count$." Average runTime : ".$row.averageRunTime$." ms Max runTime : ".$row.maxRunTime$." ms ",$customer_comment_da$." Dashboard ID : ".$row.dashboardId$." User ID : ".$row.userId$." Count : ".$row.count$." Average runTime : ".$row.averageRunTime$." ms Max runTime : ".$row.maxRunTime$." ms ")</eval> <!-- End Code to display multiple rows data in template --> <!-- Panel that runs when we click on the dashboard id. We are using using $dashTok$ from above panel to run the below query --> <set token="drilldown_display">block</set> </drilldown> </table> </panel> <panel> <table> <title>Reports based on dashboard ID</title> <search> <query>$input_index$ `logRecordType(D,R)` earliest=$earliest$ latest=$latest$ dashboardId=$dashTok$ | table reportId runTime | sort -runTime</query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <option name="drilldown">row</option> <drilldown target="_blank"> <eval token="earliest_str">$row.earliest_str$</eval> <eval token="latest_str">$row.latest_str$</eval> <eval token="earliest_str">$row.earliest$</eval> <eval token="tempEarliest">$earliest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="earliestUTC">if(isnull($earliestUTC$), strftime($tempEarliest$,"%m/%d/%y %H:%M:%S") , $earliestUTC$)</eval> <eval token="latest_str">$row.latest$</eval> <eval token="tempLatest">$latest$-19800</eval> <!-- Temp converting IST to UTC --> <eval token="latestUTC">if(isnull($latestUTC$), strftime($tempLatest$,"%m/%d/%y %H:%M:%S"), $latestUTC$)</eval> <!-- Storing top reportid using customer_comment_report token and displaying in the template --> <eval token="customer_comment_report">if(isnull($customer_comment_report$),"<!-- Code to display multiple rows data in template -->Report Id : ".$row.reportId$." RunTime : ".$row.runTime$." ms ",$customer_comment_report$." Report Id : ".$row.reportId$." RunTime : ".$row.runTime$." ms ")</eval> <!-- End Code to display multiple rows data in template --> <set token="drilldown_display">block</set> </drilldown> </table> </panel> </row> <!-- below block shows template extracted from above queries --> <row depends="$drilldown_display$"> <panel> <!-- template with row data --> <html> <h1 class="SectionHeader">Case Updation Template</h1> <div style="float:left; width:calc(95% - 100px);" class="pageInfo"> <pre> Hi Team, We have received alert for dashboards. Please see below fro more details: Upon checking, we found below dashboards took high run time on an average: $customer_comment_da$ $customer_comment_report$ Please review the above mentioned operations at your end. Thanks, Splunk Team </pre> </div> </html> </panel> </row> </form>   The expected result is to display dashboard ID and its data (for the row clicked) and also the top reportIds corresponding to that dashboardId.  However i am able to manage to get data seperately under $customer_comment_da$ and $customer_comment_report$ seperately which are not linked to each other.  ... View more

Hi @ITWhisperer  Thank you for your solution, but let me rephrase my question.  Below is the Splunk result in our dashboard panel Dashboard Count Comments DA ID 1 22 abc DA ID 2 786 def DA ID 3 10,037 ghi DA ID 4 719 jkl Upon clicking the first row (or any row in the table) we get a result in another panel for that corresponding dashboard id.  Report runTime Report 1 100 ms Report 2 200 ms Report 3 300 ms Report 4 400 ms   now my basic requirement is to display results  from both the panels above, in my block as follows : Below dashboards took high run time on an average: [1] Dashboard ID : 01ZYM00000aprt User ID : 0053600000056ZP Count : 3 Average runTime : 95860.33 ms Max runTime : 602874 ms Below are the reports in the above dashboard that's taking high runTime. ReportId | runTime (ms) ------------------------ 00O5b0000000TUF 602874 00O5b0000000POL 501030 00O5b0000000YOP 456100 [2] Dashboard ID : 02200000000apmt User ID : 005360000009999 Count : 1 Average runTime : 61830.33 ms Max runTime : 902148 ms Below are the reports in the above dashboard that's taking high runTime. ReportId | runTime (ms) ------------------------ 00O5b0000000FOO 802440 00O5b0000000HOM 701555   So I was able to store info related to dashboard ID in one token $dashTok$ (from panel 1) and the reports generated in 2nd token $repToken$ (from Panel 2)  and tried getting results as shown above. But no luck. Could you help me?   ... View more

@ITWhisperer  any thoughts on how to display data from the tabular panel to our block of text? ... View more

Perfecto @ITWhisperer  That feeling after you work on a problem for days and finally it works !!!!   Just another quick question if you could help? I have a panel displaying tabular data. I want to display the top 3 rows from that table in my template block. How do we achieve this? Let me know if you want me to create a separate thread for this.  ... View more

@ITWhisperer Yep. Agree with logic. It's a good one,  but the only output in my template block is : Hi Team, Please check the below data from our query: $customer_comment_en$ ... View more

@ITWhisperer Got your point. That's a really good solution 😄  I just tried adding the red text below as suggested by you in my dashboard and it doesn't work. Any thoughts?   <drilldown target="_blank"> <eval token="customer_comment_en">$customer_comment_en$.  " jobId : ".$row.jobId$." User ID : ".$row.userId$." " </eval>   <set token="drilldown_display">block</set> </drilldown> <row depends="$drilldown_display$"> <panel> <!-- Customer comment template with row data --> <html> <h1 class="SectionHeader">Case Updation Template </h1> <div style="float:left; width:calc(95% - 100px);" class="pageInfo"> <pre> Hi Team, Please check the below data from our query:  $customer_comment_en$ </pre> </div> </html> </panel> </row> ... View more

Hi @ITWhisperer    Thanks for the quick turnaround. I guess you got my question wrong. The intention here is  ->  jobId :  ".$row.jobId$." gives me the result of the row I clicked ( which is easy and common to implement)  jobId: 7828978761cjk -> Now when I click another row from the table, I want that result to be added to the previous data jobId: 7828978761cjk  (result from the previous click) jobId: 9887521348typ (result from current click)    Is there any ".$row2.jobId$." function that I can use?    ... View more