Dashboards & Visualizations

How to access Passed Token in new dashboard

clintla
Contributor

The new options in Splunk are great. I can edit my drilldown & goto advanced & then I can specify a token. I get that part.

The token works.

I can now see my token passed in the URL.

/en-US/app/search/openstack_tenant?%24host_cell_tok%24=option1

that option1 is exactly what I want to see & is the right clicked value

but now how to I use it. The normal token doesnt seem to work $host_cell_tok$ in the new dashboard,

When reading through the "learn more" docs, the documentation doesnt ever seem to come out & say how to use it as a host or search value in my next dashboard.

0 Karma
1 Solution

rjthibod
Champion

The issue is the url you are passing to the new dashboard has dollar signs %24 around the token name, so the token is being set with extra characters.

Without you posting the SimpleXML for your input, it is going to be hard to explain why this is happening. But I cant tell you that the drilldown should produce a url that looks like this instead.

/en-US/app/search/openstack_tenant?host_cell_tok=option1

Then you would be able to use $host_cell_tok$ as expected in the new dashboard

View solution in original post

niketn
Legend

@clintla %24 is the URL Encoded escape character for $ (dollar) sign. This tells that the token that you are trying to set in the first dashboard is either not being set as you expect or being passes as literal string character. Please post the code from first dashboard, where you are trying to set the URL along with the token. It would also be relevant to add the code where $host_cell_tok$ is being set.

It would always be a good idea to print the token in the main dashboard before you create a link to launch a new dashboard to test and confirm that token is being set as you expect.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

rjthibod
Champion

The issue is the url you are passing to the new dashboard has dollar signs %24 around the token name, so the token is being set with extra characters.

Without you posting the SimpleXML for your input, it is going to be hard to explain why this is happening. But I cant tell you that the drilldown should produce a url that looks like this instead.

/en-US/app/search/openstack_tenant?host_cell_tok=option1

Then you would be able to use $host_cell_tok$ as expected in the new dashboard

clintla
Contributor

http://10.40.111.31:8000/en-US/app/search/openstack_tenant?host1=option1

I deleted & did through the gui

when I put in the title $host1$ it literally puts in "$host1$" or do a search on $host1$ then it finds nothing as if there is no value. The URL value ID's it correctly.

0 Karma

rjthibod
Champion

First, please respond to my answer using the "Add comment" button, not by posting a new answer.

Second, I am not sure what you mean. Can you please post the XML for the dashboard that tries to do the drilldown?

0 Karma

clintla
Contributor

The source?

"
OpenStack_Tenant $host1$

<panel>
  <table>
    <search>
      <query>sourcetype=openstack host = "*tennet*"

| replace shk-tennet WITH "MetaCloud/SHK" IN host
| rename "Tenant Name" as Tenant_Name
| eval tennetinfo = (Tenant_Name + "- " +host)
| search host = $host1$
| chart values("No of STACKS") as Tenant_Stack_Count, values(host) over tennetinfo | sort -num(Tenant_Stack_Count)
@w0
now
1

100
none
none
false
false
false
true


"

0 Karma

rjthibod
Champion

You need to post the XML for the drilldown part. it looks like it was cutoff.

0 Karma

clintla
Contributor

I figured out if you put $$ into the GUI box as the left value that it adds %24 in the target URL.

here is the end again.

The way it looks.. (host1 & result) should be usable tokens in the target dashboard.
as $host1$ & $result$ right?

host1=$click.value$&result=$click.value$

      <colorPalette type="list">[#65A637,#F7BC38,#D93F3C]</colorPalette>
      <scale type="threshold">70,90</scale>
    </format>
    <format type="color" field="Allocated%">
      <colorPalette type="list">[#65A637,#F7BC38,#D93F3C]</colorPalette>
      <scale type="threshold">140,150</scale>
    </format>
    <drilldown>
      <link target="_self">/app/search/openstack_tenant?host1=$click.value$&amp;result=$click.value$</link>
    </drilldown>
  </table>
</panel>
<panel>
0 Karma

rjthibod
Champion

That sounds reasonable, but in general you should wrap the link element using the CDATA tags. Try this and make sure it works. Notice it uses the actual ampersand character and not the encoded version

<drilldown>
  <link target="_self">
    <![CDATA[
      /app/search/openstack_tenant?host1=$click.value$&result=$click.value$
    ]]>
  </link>
</drilldown>
0 Karma

clintla
Contributor

That works. Able to use the token!

Probably just an issue w/ the config through the GUI.

0 Karma

rjthibod
Champion

Glad we could straighten it out. Please accept my answer up above.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...