Resolving Drilldown Errors in Splunk Dashboard Studio: Custom URL Interaction Issue

Applicability

Description

Users reported an issue in Dashboard Studio where clicking on a panel configured to drill down to a custom URL results in an error on the first attempt. Subsequent attempts work as expected. This inconsistency impacts the usability of dashboards with URL-based drilldowns. The configuration in question used the following setup:

Token Setting: URLOTICKET derived from a row field value (row.urltoticket.value).
Drilldown Type: customUrl with the token $URLOTICKET$ as the URL.

Upon investigation, the issue arises because the token URLOTICKET is not resolved properly on the first interaction.

Investigation

Review drilldown configuration and confirmed the setup for the drilldown action:

{
    "type": "drilldown.setToken",
    "options": {
        "tokens": [
            {
                "token": "URLOTICKET",
                "key": "row.urltoticket.value"
            }
        ]
    }
},
{
    "type": "drilldown.customUrl",
    "options": {
        "url": "$URLOTICKET$",
        "newTab": true
    }
}

Initial Behavior:

First click: Error due to unresolved URLOTICKET.
Subsequent clicks: Works correctly, indicating the token gets resolved after the first interaction.

Resolution

Modify the Drilldown Configuration:

Replace the token reference $URLOTICKET$ in the custom URL with $row.urltoticket.value$ directly.

Updated configuration:

{
    "type": "drilldown.customUrl",
    "options": {
        "url": "$row.urltoticket.value$",
        "newTab": true
    }
}

Optional Enhancement:

Use the eval command to create a user-friendly column with a meaningful value (e.g., ticket: OMTask0002261) while maintaining the actual drilldown functionality:

| eval user_friendly_column = "OMTask" + task_id

Hide the original column if not required by renaming it with a leading underscore or using table column configurations.

Notes:
Validate functionality for both initial and subsequent clicks after implementing the changes.
Ensure all fields referenced in the drilldown configuration are part of the data source. By directly referencing $row.urltoticket.value$ instead of using a token, the issue was resolved. The first click now works without errors, providing a seamless user experience.

Related Links

Create Dashboard