topic Static and Dynamic Table with drilldowns in Splunk Search

Static and Dynamic Table with drilldowns

mansel_scheffel — Wed, 20 Jul 2016 11:16:34 GMT

Hi there,

I need to create a table with static headings as well as static body entries, however these body entries when clicked on will drilldown to events that are categorized under them.

IE-

So all of that would be static information. When a user clicks on "asset management" or any of the other rows under a heading it will drilldown to display events that have been categorized to it.

Any thoughts on how to go about doing this(especially adding many unique values under the headings - i am using the eval command so far)?

Thanks!

Re: Static and Dynamic Table with drilldowns

somesoni2 — Wed, 20 Jul 2016 14:55:56 GMT

I would create a static lookup table (csv) to store your static table values and use inputlookup command to populate the same.

Re: Static and Dynamic Table with drilldowns

mansel_scheffel — Wed, 20 Jul 2016 15:01:26 GMT

Thanks for the reply..

Would I then be able to create drilldowns in my dashboard and relate search values to the static inpullookup?

Re: Static and Dynamic Table with drilldowns

somesoni2 — Wed, 20 Jul 2016 15:08:34 GMT

Yes, after you show the static table from the lookup, you'll be able to setup drilldown (see below link) to another visualization/dashboard to show actual events corresponding to clicked values (see 2nd URL for different tokens available for drilldown)

http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_elements
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event_tokens

Also, install Splunk .x dashboard example app and you can find working examples of drilldowns that you can refer.
https://splunkbase.splunk.com/app/1603/

Re: Static and Dynamic Table with drilldowns

mansel_scheffel — Wed, 20 Jul 2016 15:28:50 GMT

Awesome, thats exactly what I needed.. Thanks for the help!