topic Multiple Custom Dynamic Drilldowns in Dashboards & Visualizations

Multiple Custom Dynamic Drilldowns

mcm10285 — Mon, 07 Oct 2013 03:03:51 GMT

Is it possible to have a customized drilldown result per link? The idea is a form, which will initially result to displaying the different sourcetypes of the search, then per sourcetype result, I can drilldown to a simple table or a stats table that is created based on the sourcetype that is clicked on.

For example, the form search returned 3 sourcetypes, firewall, URL filter and AV. When I click on firewall, it will drill down to a table that shows fields related to the sourcetype (src,dst,port,etc.). Same follows for the other results when clicked on, URL filter (src,dst,URL,operation, argument,user-agent, etc.) and AV (sr,dst,signature,file,etc.)

Hope this is possible and someone can share an idea.

Re: Multiple Custom Dynamic Drilldowns

melting — Mon, 07 Oct 2013 22:59:45 GMT

Yes this is possible, there are several different techniques that can be combined:

First, custom drill down lets you specify a link to take per field/series clicked on: http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Dynamicdrilldownindashboardsandforms

Second, in page drill down in Simple XML in Splunk 6.0. If you look at the Splunk 6.0 Dashboard Examples (note: requires javascript knowledge)

Lastly, use tokens to select a macro. This allows you to specify different search snippets based on user input. This is useful in either advanced xml or simple xml.

Re: Multiple Custom Dynamic Drilldowns

mcm10285 — Tue, 08 Oct 2013 03:08:31 GMT

First item cannot deliver the requirement.

Second item not feasible at this time, I am at 5.0.3.

"Lastly, use tokens to select a macro. This allows you to specify different search snippets based on user input. This is useful in either advanced xml or simple xml."

--> Is this applicable to v5.0.3? Also, would you have references that you can point me to? Thanks.

Re: Multiple Custom Dynamic Drilldowns

muellernc — Mon, 27 Jun 2016 07:37:24 GMT

I downvoted this post because link dead