This is a note to future-me on how to do row based drill downs on tables in a Splunk dashboard.
Set a token
row on the source table and set a
token based on one of the clicked values, e.g. in a
<table>, you could do:
The token can be used in further panels.
depends attribute of a panel downstream will hide it until the token has been populated
Open a link
Another type of drilldown is for a link (hint: link to a dashboard in your own instance with prepopulated tokens):
When you link to your own splunk server, use the relative URL from
/app. That way, you don’t need to worry about different user’s region settings or the server name changing.