How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

alex1895 — Tue, 09 Feb 2016 00:50:37 GMT

I want Splunk to link to different dashboards depending on the extracted field value it got from the table drilldown.

Is it possible to solve via Simple XML?

Alex

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

s2_splunk — Tue, 09 Feb 2016 04:24:32 GMT

Hi alex1895,
the snippet below is taken from the Splunk 6.x Dashboard Examples App, spcifically the "Drilldown Elements->Dynamic Drilldown" section.

Adjust the link URL to the view you want to navigate to and use $token$ values from your source view as needed.

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

alex1895 — Tue, 09 Feb 2016 05:15:44 GMT

Thanks for the reply. I am not really sure if that is the answer to my question. I know how to use Dynamic Drilldown, I just want to include a value check before exercising the drilldown. Depending on that value the dynamic drilldown would go to different places.

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

s2_splunk — Tue, 09 Feb 2016 06:52:53 GMT

I think you are sure that it is not, and I am sorry for misunderstanding your question. 🙂
This probably better describes your use case, if I get it now and I think the answer given there is accurate. You will likely have to convert to a HTML dashboard and implement your conditional logic in JavaScript.

Or maybe your use case allows you to follow the approach described here, but that depends on whether you can map your conditions to a dashboard view naming convention.

Is that more in line with what you need?

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

alex1895 — Tue, 09 Feb 2016 19:18:47 GMT

Great thanks the second one work out.

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

bandit — Tue, 20 Nov 2018 18:56:56 GMT

Drilldown example of a row click dynamically generating a URL based on field values in the row. Either absolute or relative links should work using Link to custom URL in the Drilldown Editor. I'm running Splunk 7.1

     <drilldown>
       <link target="_blank">/app/$row.app$/$row.title$</link>
     </drilldown>

Sample Dash:

  <form>
  <label>Dashboard Explorer v2</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="app" searchWhenChanged="true">
      <label>App</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>app</fieldForLabel>
      <fieldForValue>app</fieldForValue>
      <search>
        <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search NOT (app="*TA-*" OR app="*SA-*" OR app="*_TA_*") 
| table app 
| dedup app 
| sort app</query>
        <earliest>-5m</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="title" searchWhenChanged="true">
      <label>Title</label>
      <fieldForLabel>title</fieldForLabel>
      <fieldForValue>title</fieldForValue>
      <search>
        <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search NOT (app="*TA-*" OR app="*SA-*" OR app="*_TA_*") 
| table title 
| dedup title
| sort title</query>
        <earliest>-5m</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
    <input type="dropdown" token="author" searchWhenChanged="true">
      <label>Author</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>author</fieldForLabel>
      <fieldForValue>author</fieldForValue>
      <search>
        <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search NOT (app="*TA-*" OR app="*SA-*" OR app="*_TA_*") 
| table author 
| dedup author 
| sort author</query>
        <earliest>-5m</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="text" token="key_word" searchWhenChanged="true">
      <label>Key Word</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Dashboards</title>
      <single>
        <search>
          <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search app="$app$" title="$title$" author="$author$" (app="*$key_word$*" OR title="*$key_word$*" OR author="*$key_word$*") NOT (app="*TA-*" OR app="*SA-*" OR app="*_SA_*" OR app="*_TA_*" OR app="Splunk_ML_Toolkit" OR app="splunk_monitoring_console" OR app="
    unix-indexer-props") 
| table app title author type 
| stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <title>Top App</title>
      <table>
        <search>
          <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search app="$app$" title="$title$" author="$author$" (app="*$key_word$*" OR title="*$key_word$*" OR author="*$key_word$*") NOT (app="*TA-*" OR app="*SA-*" OR app="*_SA_*" OR app="*_TA_*" OR app="Splunk_ML_Toolkit" OR app="splunk_monitoring_console" OR app="
    unix-indexer-props") 
| table app title author type 
| top app 
| eval percent=round(percent,1)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="app">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="title">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="author">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="type">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <title>Top Author</title>
      <table>
        <search>
          <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search app="$app$" title="$title$" author="$author$" (app="*$key_word$*" OR title="*$key_word$*" OR author="*$key_word$*") NOT (app="*TA-*" OR app="*SA-*" OR app="*_SA_*" OR app="*_TA_*" OR app="Splunk_ML_Toolkit" OR app="splunk_monitoring_console" OR app="
    unix-indexer-props") 
| table app title author type 
| top author 
| eval percent=round(percent,1)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="app">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="title">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="author">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="type">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Dashboard List</title>
      <table>
        <title>click row to launch dashboard</title>
        <search>
          <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search app="$app$" title="$title$" author="$author$" (app="*$key_word$*" OR title="*$key_word$*" OR author="*$key_word$*") NOT (app="*TA-*" OR app="*SA-*" OR app="*_SA_*" OR app="*_TA_*" OR app="Splunk_ML_Toolkit" OR app="splunk_monitoring_console" OR app="
    unix-indexer-props") 
| table app title author type 
| sort app title</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">false</option>
        <format type="color" field="app">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="title">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="author">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="type">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <drilldown>
          <link target="_blank">/app/$row.app$/$row.title$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

topic Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML? in Dashboards & Visualizations

How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

Re: How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?