Building for the Splunk Platform

How to retrieve data from query string from URL in splunk cloud ?

shukan
Explorer

I want to fetch data from base url of splunk cloud. I want to redirect from one dashboard to another. For that , I have pass data in query string. So how can i get query string data into that ?
For ex : www.splunk.com?q=TEST
I require to pass TEST as a data in my search query.

Thanks in advance.

Tags (1)

niketn
Legend

@shukan, while I understand you want to create a token in source dashboard and pass on the same to be used in destination dashboard. Actual answer depends on how and where you are setting the token (Simple XML Dashboard Snippet if possible) and then how and where are you going to use the token (whether form level input token or not).

Following is a run anywhere example where I am setting two tokens for destination dashboard i.e. a form input token (form.tokLogLevel) and a token (tokTemp) to be used within destination dashboard.

Source Dashboard

<dashboard>
  <label>Source Dashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults
            | eval log_level=&quot;*&quot;
            | table log_level
            | append [search 
              index=_internal sourcetype=splunkd log_level=*
              | dedup log_level
              | table log_level]
          </query>
          <earliest>-24h</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <set token="tokTemp">Test Token</set>
          <link target="_blank">/app/search/splunk_answers_579408__destination_dashboard?form.tokLogLevel=$row.log_level$&amp;tokTemp=$tokTemp$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Destination Dashboard

<form>
  <label>Destination Dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tokLogLevel">
      <label>field1</label>
      <choice value="*">All</choice>
      <fieldForLabel>log_level</fieldForLabel>
      <fieldForValue>log_level</fieldForValue>
      <search>
        <query>index=_internal sourcetype=splunkd log_level=*
| dedup log_level
| table log_level</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Top count by log_level($tokLogLevel$) ($tokTemp$)</title>
      <table>
        <search>
          <query>
            index=_internal sourcetype=splunkd log_level=$tokLogLevel$
            | stats count by log_level
            | sort - count
            | head 5
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Please try out the example and see if it fits your need. If not try to provide more details of tokens between your source and destination dashboards.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

shukan
Explorer

I downvoted this post because i am asking after redirect to another page i require to use that token value , where i have redirected in search parameter.

original where i have used drilldown option and write in link tag with below value
www.splunk.com?q=test

after redirecting on www.splunk.com?q=test i am writing another splunk cloud query like sourcetype= index functionname = test which i require to fetch from querystring

0 Karma

niketn
Legend

@shukan, please use down voting option only in case the answer proves to be misleading or impacting your Splunk instance. Please understand that community members try to assist you with minimal information and without access to the actual system. If the references for various drilldown options as provided by DalJeanis, do not cater to your needs just providing the further details they way you have so that we can assist you further.

Refer to community guidelines : http://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/Splunkcommunityguidelines

and refer to following Splunk Answers thread for discussion on proper etiquettes: https://answers.splunk.lom/answers/244111/proper-etiquette-and-timing-for-voting-here-on-ans.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Can you give more information on your use case?

What information are you trying to pass from one "dashboard" to another?

What is the reason that you are not just using the same underlying search as the other dashboard?

Or, are you talking about a drilldown scenario?

0 Karma

Sukisen1981
Champion

@DalJeanis is correct.
Maybe what you need is a drill down to drill down to a hidden panel depending on token selection, have you considered that approach?

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...