topic Re: Drilldown to Show Source in Dashboards & Visualizations

Drilldown to Show Source

rwardwell — Thu, 01 Nov 2018 14:56:13 GMT

Hello All,
I have a usecase to generate a drill down from a dashboard to the "Show Source" view. I am able to open a new tab that is the show source view but it is not populated. I think I need to try and pass the sid to the show source view. I tried to do this by setting a token to equal the job.sid. However, this token has a bunch of other data such as username etc and doesn't work. Does anyone have experience linking to show source and if so how did you do it?

Thanks!

Re: Drilldown to Show Source

ak9092 — Fri, 07 Aug 2020 12:52:02 GMT

Hi @rwardwell ,

Have you had any luck in achieving this ? If yes, then can you please share your inputs as I am struggling with the same.

Re: Drilldown to Show Source

niketn — Sat, 15 Aug 2020 08:46:00 GMT

@rwardwell @ak9092 how about something like this? You have to ensure that Dashboard search for drilldown has raw events only using purely streaming command.

<dashboard> <label>Table with Show Source Drilldown</label> <search> <query>| makeresults | eval app="$env:app$"</query> <done> <set token="app">$result.app$</set> </done> </search> <row> <panel> <table> <search> <done> <set token="sid">$job.sid$</set> </done> <query>index=_internal sourcetype=splunkd log_level!=INFO | fields _time log_level _raw | head 50</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <link target="_blank">http://localhost:8000/en-US/app/$app$/show_source?sid=$sid|n$</link> </drilldown> </table> </panel> </row> </dashboard>