Splunk Dashboards and linking panels

Ah, this is an easy one, once you know how. Working with Splunk dashboards, we have a case where we have a couple of panels stacked on the left hand side of the screen, and on the right hand side, we have other dashboards that are dependent upon data on the left. Once you click to drill down onto a data item, the right hand panel should update to reflect the selection on the left.

The initial approach was just to manually edit the xml for the page and add a dropdown section like this:


The problem with doing this is that the entire dashboard will refresh (and you have to be careful to include all parameters for all panels on the page if you want just the one update to occur).

Instead, if you read carefully near the end of the documentation here, you can just do something like this:

  <set token="<field name>">$fieldvalue$</set>

And viola! Now clicking to drill down doesn’t refresh the entire page via the link, but the new panel picks up the token it had specified in it’s data, and only that panel is refreshed.


About John Woodward

Principal Consultant at Improving Enterprises, Inc.
This entry was posted in Software and tagged , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s