topic Re: Dashboard drilldown conditions in Dashboards & Visualizations

Dashboard drilldown conditions

klaudiac — Wed, 13 Jan 2021 12:45:31 GMT

Hi folks,

Quick question, but I'm running out of ideas.

I have a dashboard where I compare results between US and EU, one of the filters is "side" where I differentiate between EU and US.

When I select EU results, I'd like to be able to click on a result and it'll open up a new window with details of how that result was achieved (it's from another website)
Same scenario for when i click on the Side=NA, it leads me to a different website.

I tried this, but as far as the EU part work, the US does not...

<drilldown> <condition match="$side$ = EU"></condition> <condition> <link target="_blank">/app/SplunkEnterpriseSecuritySuite/correlation_search_edit?search=$row.rule_name$</link> </condition> <condition match="$side$ = US"></condition> <condition> <link target="_blank">www.youtube.com</link> </condition> </drilldown>

Any hints or ideas?

Thanks,

Klaudia

Re: Dashboard drilldown conditions

to4kawa — Sat, 16 Jan 2021 01:09:12 GMT

https://docs.splunk.com/Documentation/Splunk/8.1.1/Viz/DrilldownLinkToURL

where is the protocol identifier?

Re: Dashboard drilldown conditions

bowesmana — Sun, 17 Jan 2021 23:18:01 GMT

@klaudiac

You condition statements don't make sense. You have 4 conditions there, two are empty, i.e.

does not do anything, so all you have there is a single drilldown, which will most likely be the first one Splunk comes across, i.e. the link to the ES correlation search edit

Try this - note the " values before and after the EU/ES, as they should be quoted for string matching.

<drilldown> <condition match="$side$ = "EU""> <link target="_blank">/app/SplunkEnterpriseSecuritySuite/correlation_search_edit?search=$row.rule_name$</link> </condition> <condition match="$side$ = "US""> <link target="_blank">www.youtube.com</link> </condition> </drilldown>

Re: Dashboard drilldown conditions

klaudiac — Mon, 18 Jan 2021 11:47:26 GMT

That worked, thanks so much!