Tokens

The drilldown function can update token values and trigger dynamic actions on the current dashboard. Instead of navigating to another search or dashboard, drilldown can manage token values when a user clicks on a panel element.

Depending on the configuration of the dashboard, changing the token values can cause different dynamic changes to its behavior.

How it works

Managing token values is a key element of creating interactive dashboard behavior using the drilldown feature. Before configuring token value updates, you need to plan the desired behavior of the dashboard. For example, it is possible to show or hide content on user click. It is also possible to set a token value that is part of a search query to form a more detailed visualization on the dashboard.

In the drilldown, you can set or change token values on user click. However, changing token values alone does not result in dynamic panel behavior. To provide interactivity, you must configure the panel elements to respond to these token updates.

Configuration Steps

Configuration on token management is done according to the following instructions:

1. On the dashboard where you want to customize the drilldown, click Edit.

2. Select the panel where you want to customize the drilldown and click on the customization icon.

3. Select the Token Control link type.

   

4. Configure the required list of tokens to be used.

5. Click Apply Settings to apply the drilldown.

6. Click Save to save the changes to the dashboard.

Examples

This dashboard presents a table with the number of events by action type. When a user clicks on a row of the table, an additional visualization appears.

In the drilldown editor there is a possibility to configure token management for each panel. To do this, you need to configure key-value pairs.

In order for the control panel to be displayed only when a specific user action occurs, the depends attribute must be used.

{
  "label": "Last 5 events with action: $eventAction$",
  ...
  "depends": ["$eventAction$"]
}

The picture below shows the dashboard after the user clicked on the logged-in action type in the table.

Source Code

{
  "label": "Windows Events: Actions Statistics",
  "inputs": [],
  "rows": [
    {
      "panels": [
        {
          "inputs": [],
          "height": "not_set",
          "label": "Users Actions",
          "type": "sm",
          "viz": {
            "options": {
              "colorRuleList": [
                {
                  "field": "Count",
                  "colorScheme": "scale",
                  "pallete": "white_to_green",
                  "show": true,
                  "isBackground": true
                }
              ],
              "tableAutoWidth": true,
              "pagination": {
                "enabled": true,
                "rowsPerPageList": [
                  {
                    "label": "5"
                  },
                  {
                    "label": "10"
                  },
                  {
                    "label": "25"
                  },
                  {
                    "label": "50"
                  }
                ]
              },
              "sme": {
                "query": "source windows_events\r\n| aggs count by event.action\r\n| rename event.action as \"Actions\", count as \"Count\""
              },
              "summary": {
                "enabled": false
              },
              "drilldown": {
                "enableDrilldown": true,
                "drilldownType": "tokenControl",
                "drilldownText": "/app/sm-dashboards/windows_events_actions#?_q=(eventAction:'$row.Actions$')",
                "drilldownQuery": "source windows_events\r\n| search event.action=\"$row.Actions$\"",
                "drilldownCustomTimeTokenEarliest": "now-24h",
                "drilldownCustomTimeTokenLatest": "now",
                "drilldownSelectTimeToken": "customPicker",
                "drilldownTokens": [
                  {
                    "name": "$eventAction$",
                    "value": "$row.Actions$"
                  }
                ]
              },
              "timeToken": "",
              "dataTypes": {}
            },
            "timeToken": "",
            "type": "table"
          },
          "subpanels": []
        }
      ]
    },
    {
      "panels": [
        {
          "inputs": [
            {
              "name": "eventAction",
              "label": "Action",
              "type": "selection",
              "token": {
                "prefix": "",
                "suffix": ""
              },
              "options": {
                "static": [],
                "default": "",
                "filter": {
                  "label": "",
                  "value": ""
                },
                "search": ""
              },
              "timeInput": "",
              "oldName": "eventAction"
            }
          ],
          "height": "not_set",
          "label": "Last 5 events with action: $eventAction$",
          "type": "sm",
          "viz": {
            "options": {
              "colorRuleList": [],
              "tableAutoWidth": true,
              "pagination": {
                "enabled": true,
                "rowsPerPageList": []
              },
              "sme": {
                "query": "source windows_events\r\n| search event.action=\"$eventAction$\"\r\n| table @timestamp, host.name,user.name, event.code, event.action, event.outcome\r\n| head 5\r\n| rename @timestamp as \"Time\", host.name as \"Host\", user.name as \"User\", event.code as \"Event Code\", event.action as \"Action\", event.outcome as \"Outcome\""
              },
              "summary": {
                "enabled": false
              },
              "drilldown": {
                "enableDrilldown": false,
                "drilldownType": "search",
                "drilldownText": "",
                "drilldownQuery": "",
                "drilldownCustomTimeTokenEarliest": "now-24h",
                "drilldownCustomTimeTokenLatest": "now",
                "drilldownSelectTimeToken": ""
              },
              "timeToken": ""
            },
            "timeToken": {
              "start": "now-24h",
              "end": "now"
            },
            "type": "table"
          },
          "depends": [
            "$eventAction$"
          ],
          "subpanels": []
        }
      ]
    }
  ],
  "vars": []
}