topic Re: Specify drill down search in Dashboards & Visualizations

Specify drill down search

paddy3883 — Mon, 28 Sep 2020 12:39:20 GMT

I'm relatively new to Splunk and am creating a new view to display the average timings of certain events over the past 5 mins. I've created a macro search to carry out the search which takes two parameters (transaction name and duration to search), so in my first panel this is EVENT_*_LOGIN and -5m. The view currently displays a simple table of results per distinct event name.

What I would like to do is when a user clicks on a particular row it will drill down to timeline view of all events for that transaction over the past 4 hours. Is there a way to specify the information a click or drill down displays?

Apologies if this vague, please message me if more info. needed.

Re: Specify drill down search

paddy3883 — Mon, 22 Oct 2012 13:24:08 GMT

I found the way to do this within the Advanced XML documentation

Re: Specify drill down search

smolcj — Thu, 29 Nov 2012 09:27:24 GMT

is it possible to do it in simple xml?

Re: Specify drill down search

paddy3883 — Thu, 29 Nov 2012 10:26:46 GMT

Hi yes I think it is, I asked the query during my initial learnings of Splunk. http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms might prove useful