topic how to link two dashboards in splunk 6.2 in Dashboards & Visualizations

how to link two dashboards in splunk 6.2

sunnyparmar — Mon, 30 Nov 2015 11:02:39 GMT

Hi,

I have two different dashboards one for disk space usage and other for memory and CPU utilization for two different hosts. I want to link them so that if i select one host in drill down so automatically its shows me the other KPI values also so is there any way to do this. Please give your valuable suggestions.

Thanks

Re: how to link two dashboards in splunk 6.2

renjith_nair — Fri, 04 Dec 2015 03:34:34 GMT

Just a small suggestion : Have you tried using different panels on the same dashboard? It should give you an overall idea about all the metrics at a glance.

For two different dashboard, you can use drill down to pass the host value to the second dashboard and use it on that dashboard

For eg:

<table>
  <title>Details</title>
  <search> < search terms></search>
  <option name="wrap">true</option>
  <option name="<something"><something></option> 
  <drilldown>
    <link>/app/<appname>/<page name>?form.index=$row.index$&amp;form.host=$row.host$&amp</link>
  </drilldown>
  <option name="drilldown">row</option>
</table>

Re: how to link two dashboards in splunk 6.2

forkingforwardt — Fri, 04 Dec 2015 09:30:16 GMT

use two pannels on a dashboard even for simply doing.
install Splunk 6.x Dashboard Examples apps it is help you very fine to do it
as several example thereof is inside, following this link https://splunkbase.splunk.com/app/1603/ to download

Re: how to link two dashboards in splunk 6.2

fdi01 — Fri, 04 Dec 2015 09:35:50 GMT

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 29 Sep 2020 08:04:41 GMT

Hi,

I have made something like this within my xml code in which my first query refers to target per_host_kpi's dashboard and another query refers the target to another host overview dashboard but the issue is it is giving output for first dashboard. When I clicked on the main screen overview it takes me to the per host kpi's dashboard but when i clicked on second its not taking me to the another dashboard so any idea for this?

Dynamic Drilldown

<panel>
  <table>
    <search>
      <query>index=sc-perfmon (collection=cputime counter="% User Time") OR (collection=Memory counter="% Committed Bytes In Use") | stats sparkline(avg(Value)) as "Load trend", latest(_time) as latest_event, latest(eval(round(Value, 2))) as "Latest value" by host,collection |eval "Seconds since latest event"=floor((now() -latest_event)) | eval "Host metric"=case(collection == "CPUTime", "CPU time user %", collection == "Memory", "Memory in use %") | table host, "Host metric", "Latest value", "Load trend", "Seconds since latest event"</query>
      <earliest>-7d@h</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <link target="_blank">http://10.0.xx.xx:xx/en-US/app/sc_monitoring/per_host_kpis?form.src_type_tok=$row.sourcetype$</link>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
    <search>
      <query>index=sc-perfmon collection=FreeDiskSpace counter="% Free Space" NOT(instance=_Total) |chart max(eval(ceiling(100-Value))) as disk_in_use over host by instance</query>
      <earliest>-7d@h</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <link target="_blank">http://10.0.xx.xx:xx/en-US/app/sc_monitoring/host_overview?form.src_type_tok=$row.sourcetype$</link>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
  </table>
</panel>

thanks

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 29 Sep 2020 08:04:44 GMT

Hi,

Dynamic Drilldown

<panel>
  <table>
    <search>
      <query>index=sc-perfmon (collection=cputime counter="% User Time") OR (collection=Memory counter="% Committed Bytes In Use") | stats sparkline(avg(Value)) as "Load trend", latest(_time) as latest_event, latest(eval(round(Value, 2))) as "Latest value" by host,collection |eval "Seconds since latest event"=floor((now() -latest_event)) | eval "Host metric"=case(collection == "CPUTime", "CPU time user %", collection == "Memory", "Memory in use %") | table host, "Host metric", "Latest value", "Load trend", "Seconds since latest event"</query>
      <earliest>-7d@h</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <link target="_blank">http://10.0.xx.xx:xx/en-US/app/sc_monitoring/per_host_kpis?form.src_type_tok=$row.sourcetype$</link>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
    <search>
      <query>index=sc-perfmon collection=FreeDiskSpace counter="% Free Space" NOT(instance=_Total) |chart max(eval(ceiling(100-Value))) as disk_in_use over host by instance</query>
      <earliest>-7d@h</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <link target="_blank">http://10.0.xx.xx:xx/en-US/app/sc_monitoring/host_overview?form.src_type_tok=$row.sourcetype$</link>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
  </table>
</panel>

thanks

Re: how to link two dashboards in splunk 6.2

renjith_nair — Tue, 29 Sep 2020 08:08:10 GMT

From your example, you are trying to do drill down in same panel on same table unless you haven't pasted complete code. You can have only one drill down per table as far as I know.

If its a second table, please make sure that you have a page host_overview and it's using a token src_type_tok.

Interestingly, there is no sourcetype field in any of your searches (probably complete xml is not pasted here)

So , there should be a page per_host_kpis and should have a src_type_tok token and there should be another page host_overview also with src_type_tok token

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 08 Dec 2015 09:19:48 GMT

thanks for the answer but still not able to get it clear.. could you have some code that you have implemented on your side so can you share it please?

Thanks

Re: how to link two dashboards in splunk 6.2

renjith_nair — Tue, 08 Dec 2015 09:46:54 GMT

From the first dashboard(source) , I take sourcetype from the table and pass it to target dashboard.

    <dashboard>
      <label>Source </label>
      <row>
        <panel>
          <table>
            <title>Sourcetypes</title>
            <search>
              <query>index=*|stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
            </search>
            <option name="wrap">undefined</option>
            <option name="rowNumbers">undefined</option>
            <option name="drilldown">row</option>
            <drilldown>
              **<link>/app/search/target?form.sourcetype=$row.sourcetype$</link>**
            </drilldown>
          </table>
        </panel>
      </row>
    </dashboard>

In the target dashboard I am using the token in my search

<dashboard>
  <label>Target</label>
  <row>
    <panel>
      <table>
        <title>Details</title>
        <search>
          <query>index=* sourcetype=**$form.sourcetype$**</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</dashboard>

And from target I can drilldown to another page, and so on. If you want to call back the source page from target, make sure that in the source dashboard, you are using the token which is passed from target.

Hope this helps

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 08 Dec 2015 10:45:48 GMT

thanks for the sharing.. I have used your first dashboard (source) like in given below format but it is giving error no result found. Could you tell me please where i am wrong

   <label>host_kpi's </label>
   <row>
     <panel>
       <table>
         <title>Perfmon:CPUTime </title>
         <search>
           <query>index=sc-perfmon|stats count by Perfmon:CPUTime </query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
         <option name="wrap">undefined</option>
         <option name="rowNumbers">undefined</option>
         <option name="drilldown">row</option>
         <drilldown>
           **<link>/app/search/target?form.sourcetype=$row.sourcetype$</link>**
         </drilldown>
       </table>
     </panel>
   </row>
 </dashboard>

Re: how to link two dashboards in splunk 6.2

renjith_nair — Tue, 08 Dec 2015 10:49:34 GMT

The ** around link is badly formatted bold. Please remove that and only use

          <drilldown>
            <link>/app/search/target?form.sourcetype=$row.sourcetype$</link>
          </drilldown>

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 08 Dec 2015 10:53:44 GMT

still no result found..

Re: how to link two dashboards in splunk 6.2

renjith_nair — Tue, 08 Dec 2015 10:56:12 GMT

The result not found is due to lack of events. Do you have some events for below search.

index=sc-perfmon earliest=-15m|stats count by Perfmon:CPUTime

Also does it have sourcetype column in the table. By $row.sourcetype$ we are picking up the sourcetype column from the row you clicked for drilldown

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 08 Dec 2015 10:58:00 GMT

no.. don't get any result for the query.. so what to do in this case? Please suggest.. thanks

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 08 Dec 2015 10:58:19 GMT

no.. don't get any result for the query.. so what to do in this case? Please suggest.. thanks

Re: how to link two dashboards in splunk 6.2

renjith_nair — Tue, 08 Dec 2015 11:01:26 GMT

So if you don't have a result, we can not do anything unless you push some data 🙂

In between do you have some results for index=sc-perfmon earliest=-15m ? or increase the time window.

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 08 Dec 2015 11:01:29 GMT

answer for your question - does it have sourcetype column in the table. By $row.sourcetype$ we are picking up the sourcetype column from the row you clicked for drilldown

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 08 Dec 2015 11:05:24 GMT

yes.. i am getting data for this much query (index=sc-perfmon earliest=-15m )

Re: how to link two dashboards in splunk 6.2

sunnyparmar — Tue, 08 Dec 2015 11:10:39 GMT

I have tried this query (index=sc-perfmon earliest=-15m|stats count by Perfmon:CPUTime
) on my production server as well but there also i didn't get any data.. actually previously i was running query on Splunk test server .. but on production also it is not giving any data with this query

Re: how to link two dashboards in splunk 6.2

renjith_nair — Tue, 08 Dec 2015 11:16:13 GMT

To drill down from a table , the table should have the field name to pass as the token.

From your original dashboard, i took host as drilldown token since host is part of result set

Dashboard 1

      <dashboard>
       <label>Source</label>
       <row>
         <panel>
           <table>
             <title></title>
             <search>
               <query>index=sc-perfmon (collection=cputime counter="% User Time") OR (collection=Memory counter="% Committed Bytes In Use") | stats sparkline(avg(Value)) as "Load trend", latest(_time) as latest_event, latest(eval(round(Value, 2))) as "Latest value" by host,collection |eval "Seconds since latest event"=floor((now() -latest_event)) | eval "Host metric"=case(collection == "CPUTime", "CPU time user %", collection == "Memory", "Memory in use %") | table host, "Host metric", "Latest value", "Load trend", "Seconds since latest event"</query>
               <earliest>-7d@h</earliest>
               <latest>now</latest>
             </search>
             <option name="wrap">undefined</option>
             <option name="rowNumbers">undefined</option>
             <option name="drilldown">row</option>
             <drilldown>
                <link>http://10.0.xx.xx:xx/en-US/app/sc_monitoring/per_host_kpis?form.host=$row.host$</link>
             </drilldown>
           </table>
         </panel>
       </row>
     </dashboard>

Dashboard 2

I used the host which is passed from source to filter the result in search query

     <dashboard>
       <label>Target</label>
       <row>
         <panel>
           <table>
             <title></title>
             <search>
               <query>index=sc-perfmon collection=FreeDiskSpace counter="% Free Space" NOT(instance=_Total) host=$form.host$ |chart max(eval(ceiling(100-Value))) as disk_in_use over host by instance</query>
               <earliest>-7d@h</earliest>
               <latest>now</latest>
             </search>
             <option name="wrap">undefined</option>
             <option name="rowNumbers">undefined</option>
             <option name="drilldown">row</option>
           </table>
         </panel>
       </row>
     </dashboard>

You have to now look at your data and fine tune according to your requirement.

Hope this helps!