Define Your Drilldown in Splunk: $click.value$ vs $click.value2$

In Splunk, there’s a lot to get right when it comes to choosing tokens for your dashboard when using drilldown. Deciding what values to select for your token names and token values in your dashboard drilldown menu can get confusing. You may be asking…

How do I know what to name my tokens?

What are all those prebuilt token values in the dropdown menu, and what do they do?

Passing tokens to your dashboard, linking them to other dashboard panels, or linking them to searches can advance your dashboard visualizations and data analytics. Multiple tokens can be used with dashboard drilldown in Splunk, but today we’ll be discussing two of the most commonly selected token values: $click.value$ and $click.value2$. By the end of this post, you will understand when to select one over the other to fit your dashboarding needs. Let’s get started!

 

The Drilldown

First off, you’ll need to edit your dashboard drilldown menu by going into your dashboard’s edit mode. Then, select “manage tokens on this dashboard”. The screen will look similar to the one below:

$click.value$

$click.value$ is where you can set your token names and select token values from the dropdown menu.

I like to give my tokens names that are relevant and easy to remember. I have decided to name my token “cell_clicked” because I will be clicking on a cell within my dashboard and observing the results that populate. In this first example, we will explore what happens when the token “cell_clicked” is paired with the token value of “$click.value$”.

After saving the changes made, I decided to click on the status value of 200 and observe the results below in the linked dashboard panel. The results show us the events related to the GET request method… but why? When you use the token value of “$click.value$”, it will always display the leftmost cell value for the row in which you click. It will not display the events for the individual cell clicked.

 

 

$click.value2$

If you wanted to return the results from the cell value of status 200 that the mouse is hovering over, you would need to use the “$click.value2$” token. As you can see, when I edit my dashboard drill-down menu and select “$click.vaule2$” instead of “$click.value$”, the events from the exact cell clicked on the dashboard will populate the corresponding events below. Based on your needs when selecting values from a chart-style dashboard, you should be able to decide which of these two tokens is more applicable for your use case.

Bonus Tip

Keeping the second panel of the dashboard out of view can provide a cleaner look to the initial dashboard display, as seen in the image below. Follow this quick tip to achieve this view:

The second panel will remain hidden until the click value is passed to it. To accomplish this, you can edit the source code of the dashboard to add the following line:

<panel depends=“$insert_token_name$”>

Save the changes and reload to see your new dashboard! Test to see if the token is being passed correctly by clicking on the cell and seeing the corresponding events populate below.

Splunk Pro Tip: This type of work can be a considerable resource expense when executing it in-house. The experts at Kinney Group have several years of experience architecting, creating, and solving in Splunk. With Expertise on Demand, you’ll have access to some of the best and brightest minds to walk you through simple and tough problems as they come up.

See for Yourself

Ask the Experts

Looking for more tips to advance your Splunk visualizations? Ask the experts at Kinney Group! We supply new Splunk resources every week, like this tutorial on Choropleth maps. If you think your company could benefit from our professional services, our Expertise on Demand team is ready to address your unique Splunk needs. Fill out the form below to learn how we can help.