topic Re: Interactive dashboard stats count in Splunk Search

Interactive dashboard stats count

jsalsbur — Fri, 07 Jun 2019 17:13:59 GMT

Good afternoon
I have a stats count query leading to a single number dashboard. I was wondering if it is possible to make that dashboard interactive to click on then showing another query to show the different sites that is creating the single number ?

so I use index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor |stats count so my number would be 3
so if that number were to drop to two because a site went down could I click on that number dashboard and bring up a query to check on all three sites?

Re: Interactive dashboard stats count

niketn — Fri, 07 Jun 2019 18:26:45 GMT

@jsalsbur you would need to post your query again using the code button 101010 (or shortcut Ctrl+K) so that special characters in your SPL do not escape.

Having said this, if you are using Single Value visualization or Table (Or any other Splunk's built in Visualization) to show the count you can create the Drilldown to execute another search in a different panel (and display the same) using a token. Refer to Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ContextualDrilldown

You can also get Splunk Dashboard Examples app from Splunkbase, which has several examples of creating Drilldown in Splunk.

For the community to assist you better please add more details as to what is your current visualization showing count? Which field will identify site? and How would you identify a site which is down?

Re: Interactive dashboard stats count

VatsalJagani — Sat, 08 Jun 2019 05:11:31 GMT

Hello @jsalsbur,

It is an idea of drill down and I usually use two kinds of drill down in this case.

In page drilldown (My personally favorite)
Drill down to search

For Drill-down to search page you can do that from UI.

In-page drilldown is where the user can click on single-view and right bottom of that user can see all values. Here is how you can do it.

<search id="my_search">
  <query>index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor</query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
</search>

<row>
  <panel>
    <single>
      <search base="my_search">
        <query>stats count</query>
      </search>
    </single>
    <drilldown>
      <set token="tkn_open_sensor_values">1</set>
    </drilldown>
  </panel>
</row>
<row depends="$tkn_open_sensor_values$">
  <panel>
    <table>
      <search base="my_search">
        <query>table sensor</query>
      </search>
    </single>
  </panel>
</row>

Notice here we have two panels but second table only opens when user clicks on the single-view panel. Also to notice here that your query will run only once to show both the panels.

Hope this helps!!!

Re: Interactive dashboard stats count

jsalsbur — Tue, 11 Jun 2019 14:22:45 GMT

Thank you this helped me accomplish it!!