Building for the Splunk Platform

drilldown token not working

sarit_s
Communicator

Hello

I have a dashboard with 2 panels, in the second one i have a drilldown with link to search

i'm trying to configure token but it is not working

this is what i tried to do:

  <init>
    <set token="TransactionId">$TransactionId$</set>
  </init>

and this is what im getting once clicking on the link:

TransactionId=$TransactionId$ 

what am i missing ?

thanks

Labels (1)
Tags (1)
0 Karma

ppudota1
New Member

Try using this if you have a column named TransactionId and trying to store it in a token when clicked

 

 <init>
    <set token="TransactionId">$row.TransactionId$</set>
  </init>

  

0 Karma

sarit_s
Communicator

 

this is the result

TransactionId=$row.TransactionId$ 
0 Karma

IZ88
Path Finder

Hi sarit_s,

What initiates the var $TransactionId$? Is it an input from the user? a search result from one of the searches in the dashboard?

0 Karma

sarit_s
Communicator

Hello

the value is taken from the search before. it is a drilldown

0 Karma

IZ88
Path Finder

If the value is passed down from another search you shouldn't use <init><set>

by doing so you remove any value that TransactionId token might have held when the search was called.

 

Just to make sure that I understand the flow:

A base search->clicking the result->opening a new search that should use the result from the previous search

 

is it correct?

 

0 Karma

sarit_s
Communicator

Hey

yes, it’s correct 

i also tried with click.value2

0 Karma

IZ88
Path Finder

If the drill down open a brand new search the simplest way would be to set the drilldown from the editor as 'link to search" and then once you click the value it will be added as a search parameter in the new search.

If the drilldown is connected to the second panel in your dashboard, you should set the token as "click.value2" and make sure that the other panel is dependent on the value of the token.

0 Karma

sarit_s
Communicator

the drilldown is depends on the second panel and i tried to use click.value2 but it is not working 

maybe im using it wrong 

i put this :

<set token="TransactionId">$click.value2$</set>

under the drilldown object and i get this error once trying to edit the drilldown through the ui:

 

sarit_s_0-1635164387707.png

 

0 Karma

IZ88
Path Finder

Try to delete the lines you've added in the XML.

You can use the editor to add the token

IZ88_0-1635168029905.png

The location of the code in the XML is important, if the <set> command isn't associated with the right panel, the token won't be able to populate. 

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...