Dashboards & Visualizations

Token passed from one dashboard to another dashboard is being set to * automatically

moonie
Explorer

I have two dashboards I am currently working with.
On the first dashboard I have two column chart panels, where the second one is based on the first one. So if I click on a column on the first chart it sets a token, based on this token the other panel appears with its results.
Now if I click on one of those columns I want to set a second token. So far so good.
I want to send these tokens as inputs for the second dashboard where I need to work with them. The first token should be passed to a dropdown input which works perfectly fine, no troubles here. The second token on the other hand needs to be passed to a multiselect input, which somehow doesn't work. The passing itself works perfectly fine, the url I get when opening the new tab to the other dashboard is good, but it somehow automatically changes the second token to a asterisk *.
I tried tiping the url manually but it still happens, so I think something is wrong with the second dashboard. I guess there may be a problem with my inputs, since every input I have is based on another input, like a "higher level" input. My code is like this:

 

<fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="first_level">
      <label>1st Group</label>
      <prefix>1st_level="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>1st_level</fieldForLabel>
      <fieldForValue>1st_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) 
| search parent_group="CEO"
| stats count by 1st_level</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <unset token="form.2nd_level"></unset>
        <unset token="form.3rd_level"></unset>
        <unset token="form.4th_level"></unset>
        <unset token="form.5th_level"></unset>
      </change>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="multiselect" token="2nd_level">
      <label>Second Level Group</label>
      <prefix>(</prefix>
      <suffix> OR 2nd_level="n/a")</suffix>
      <valuePrefix>2nd_level="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>2nd_level</fieldForLabel>
      <fieldForValue>2nd_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) 
| search parent_group="CEO"
| search $1st_level$
| stats count by 2nd_level
</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="multiselect" token="3rd_level">
      <label>Third level group</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>(</prefix>
      <suffix> OR 3rd_level="n/a")</suffix>
      <initialValue>*</initialValue>
      <valuePrefix>3rd_level="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>3rd_level</fieldForLabel>
      <fieldForValue>3rd_level</fieldForValue>
      <search>
        <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) , 3rd_level=if(parent_group_count&gt;=4, mvindex(parent_group, -4), "n/a")
| search parent_group="CEO" 
| search $1st_level$ $2nd_level$
| search 2nd_level!="n/a"
| stats count by bc_name_2nd</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>

 

I have two more deeper inputs, but I think you know how they work now. At first I thought the problem was resulting from the preselected "All" value, but when I changed to to nothing it didn't help.
My guess is that it's coming from the Queries that are based on the higher level input, but I have no clue how I can prevent that without losing the token search filters.
Any help is highly appreciated!! I've been stuck on this problem for hours now. 😞

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...