Splunk Dashboard

[shruthiangadi]

How to link the existing dashboard to one of the column name in statistics table ?

[gcusello]

Hi @shruthiangadi,
see in Dashboard Examples App the dashboard "Drilldown Link to Dashboard"

In other words, add to your panels options

    <option name="charting.drilldown">all</option>
    <drilldown>
         <link target="_blank">/app/simple_xml_examples/simple_form_text?form.limit=$click.value2$</link>
    </drilldown>

Where:

• simple_form_text is the name of the new dashboard,
• form.limit=$row.fieldname$ is one token passed from the panle to the new dashboard.

You can pass more tokens if you need.

You can find infos about tokens at https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/tokens and https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/TokenReference

Ciao.
Giuseppe

[shruthiangadi]

Hi Gcusello,

Thank you for your time and solution.

But when i use all command i get error and also was not able to link to my dashboard.

Actually there is dashboard and its visualization type is statistics table so its in table format , so we have like 5 columns, for ex one column name is digital fitness so when i click on column digital fitness it should take me to the corresponding dashboard of digital fitness so how can i link this?

[gcusello]

Hi @shruthiangadi,
you have to assign to dashboard name as a token.
In other words, if you have a search where you tale logs from a windows index and a linux index and you want to open a different dashboard depending on the tipe of system, you should run a search something like this:

index=wineventlog OR index=os
| eval dashboard=if(index=wineventlog,"form_windows","form_linux")
| stats values(dashboard) AS dashboard count BY host

where you have the columns you need and an additional column containing the drilldown dashbord name.
then in the option of your table you add a line containing the fields you want to display (all but not dashboard):

<fields>host,count</fields>

then you add the drilldown tags with the dashboard name as a token and eventually other tokens (e.g. host):

<drilldown>
   <link target="_blank">/app/my_app/$row.dashboard$?host=$row.HostName$</link>
</drilldown>

Globally, you'll have something like this:

<row>
   <panel>
      <table>
         <title>my title</title>
         <search>
            <query>
                index=wineventlog OR index=os
                | eval dashboard=if(index=wineventlog,"form_windows","form_linux")
                | stats values(dashboard) AS dashboard count BY host``
            </query>
         </search>
         <fields>host,count</fields>
         <option name="count">100</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">row</option>
         <option name="percentagesRow">false</option>
         <option name="refresh.display">progressbar</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
         <drilldown>
            <link target="_blank">/app/my_app/$row.dashboard$?host=$row.host$</link>
         </drilldown>
      </table>
   </panel>
</row>

Ciao.
Giuseppe

[to4kawa]

please provide your expected result.

[shruthiangadi]

Actually there is dashboard and its visualization type is statistics table so its in table format , so we have like 5 columns, for ex one column name is digital fitness so when i click on column digital fitness it should take me to the corresponding dashboard of digital fitness so how can i link this?