topic Splunk dashboard clickable table output in Splunk Search

Splunk dashboard clickable table output

vadlamudi — Wed, 13 Oct 2021 18:47:07 GMT

Hi There,

I have two queries [Query 1 and Query 2]. what i am planning to achieve is that when user clicks on the server_ID for tabular output of Query 1, then it should be passed as INPUT to the WHERE clause in Query 2 . Any help would be appreciated.

Query 1:

index=<<index_name>> sourcetype=webserver | dedup server_ID | table server_ID

Query 1 Output:

server_ID

49552473-567

d5eedf55-dca

5d4bb774-74a

03f03042-1f7

Query 2:

index=<< index_name>> "Exception" | where server_ID= "server_ID from Query1 table"

Thank You

Re: Splunk dashboard clickable table output

somesoni2 — Wed, 13 Oct 2021 18:57:42 GMT

This link should get you started.

https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/ContextualDrilldown

Re: Splunk dashboard clickable table output

richgalloway — Wed, 13 Oct 2021 19:01:05 GMT

There's a pretty good example of that in the Dashboards and Visualizations manual at https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/ContextualDrilldown#Manage_and_respond_to_token_values_in_Simple_XML

The concept is the first query has a <drilldown> element that sets a token value to the clicked cell. The second query references that token. The second query won't run until the token is assigned a value (when the user clicks on the table).

<query>index=<<index_name>> sourcetype=webserver | dedup server_ID | table server_ID</query> <drilldown> <set token="server_ID">$row.server_ID$</set> </drilldown>

index=<< index_name>> "Exception" | where server_ID= $server_ID$

Re: Splunk dashboard clickable table output

vadlamudi — Wed, 13 Oct 2021 19:18:37 GMT

HI @richgalloway I am facing with below error when i tried the above solution that you provided.

ERROR: Node drilldown is not allowed here

Thank You

Re: Splunk dashboard clickable table output

richgalloway — Wed, 13 Oct 2021 20:01:06 GMT

Why did you accept the answer if it doesn't work?

The dashboard code in the answer is not complete. The snippets provided need to be inserted into the proper places in your XML.