Archive
Highlighted

Can you help me make a drill down that shows advanced information about a specific person?

Communicator

Hi all,

I need to make a drill down from a list, sending me to a dashboard for a specific data.

In more words, i have a list of people that — when i click on a person — will send me to a dashboard showing data for that specific person. If anything I wrote makes sense...

Also, forgive me if i didn't chew all documentation prior to this question. It Is a bit hard for me to understand it as i am just at the beginning of understanding Splunk.

Thank you.

0 Karma
Highlighted

Re: Can you help me make a drill down that shows advanced information about a specific person?

SplunkTrust
SplunkTrust

@bogdan_nicolescu

Refer this doc - http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/DrilldownLinkToDashboard
Also, below is a run anywhere example if it helps

Main Dashboard

<dashboard>
  <label>Drilldown Dashboards</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">/app/search/detailed_dashboard?form.sourcetype=$click.value2$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Detailed drill down dashboard

<form>
  <label>Detailed Dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype">
      <label>sourcetype</label>
      <choice value="a">a</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=$sourcetype$|stats count by index,source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Highlighted

Re: Can you help me make a drill down that shows advanced information about a specific person?

Communicator

Hi there,

I tried this:

<dashboard>
  <label>ESA</label>
  <description>Oameni</description>
  <row>
    <panel>
      <title>Lista</title>
      <table>
        <search>
          <query>| pivot Lista_angajati RootObject values(min_in) AS "Distinct Values of min_in" values(diff_time_in_out_min) AS "Distinct Values of diff_time_in_out_min" values(max_out) AS "Distinct Values of max_out" SPLITROW date_yyyymmdd AS date_yyyymmdd SPLITROW name_employee AS name_employee SORT 100 date_yyyymmdd ROWSUMMARY 0 COLSUMMARY 0 SHOWOTHER 1</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">/app/splunk_app_db_connect/form.sourcetype=$click.value$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

And doesn't work well. I get some type of errors.

Thnx.

0 Karma
Highlighted

Re: Can you help me make a drill down that shows advanced information about a specific person?

SplunkTrust
SplunkTrust

@bogdan_nicolescu,

form.sourcetype should be replaced by the target dashboard's token name. For e.g. assuming that your dashboards are running in splunkappdbconnect and the field name is `nameemployee`. Then the target should have a visualization and has a token reference - lets say $name_employee$ . So this drilldown will be

<link target="_blank">/app/splunk_app_db_connect/dashboard_name?form.name_employee=$click.value$</link>

0 Karma
Highlighted

Re: Can you help me make a drill down that shows advanced information about a specific person?

Communicator

Ok, but .... how do i connect this to a dashboard made to show a column graph for couple days ...

Thnx.

0 Karma
Highlighted

Re: Can you help me make a drill down that shows advanced information about a specific person?

Communicator

i have this for the next dashboard:

(index=* OR index=_*) (index=db_esa sourcetype=DB_ESA_log source=EDSA_PROD) | rename access_permited AS RootObject.access_permited avg_time_mi AS RootObject.avg_time_mi created_date AS RootObject.created_date date_dd AS RootObject.date_dd date_ddmmyyyy AS RootObject.date_ddmmyyyy date_mm AS RootObject.date_mm date_yyyy AS RootObject.date_yyyy date_yyyymmdd AS RootObject.date_yyyymmdd diff_time_in_out_min AS RootObject.diff_time_in_out_min first_name AS RootObject.first_name last_name AS RootObject.last_name location AS RootObject.location max_out AS RootObject.max_out min_in AS RootObject.min_in name_employee AS RootObject.name_employee qr_code AS RootObject.qr_code reader_id AS RootObject.reader_id sum_time_mi AS RootObject.sum_time_mi trunc_created_date AS RootObject.trunc_created_date | search "RootObject.name_employee"="*" | fields "_time" "host" "source" "sourcetype" "RootObject.access_permited" "RootObject.avg_time_mi" "RootObject.created_date" "RootObject.date_dd" "RootObject.date_ddmmyyyy" "RootObject.date_mm" "RootObject.date_yyyy" "RootObject.date_yyyymmdd" "RootObject.diff_time_in_out_min" "RootObject.first_name" "RootObject.last_name" "RootObject.location" "RootObject.max_out" "RootObject.min_in" "RootObject.name_employee" "RootObject.qr_code" "RootObject.reader_id" "RootObject.sum_time_mi" "RootObject.trunc_created_date"
0 Karma
Highlighted

Re: Can you help me make a drill down that shows advanced information about a specific person?

SplunkTrust
SplunkTrust

@bogdan_nicolescu,
Change the below in the above search and try clicking from the first dashboard

search "RootObject.name_employee"="*"
to
search "RootObject.name_employee"="$name_employee$"

0 Karma
Highlighted

Re: Can you help me make a drill down that shows advanced information about a specific person?

Communicator

Did that and i get error.

Thnx.

0 Karma
Highlighted

Re: Can you help me make a drill down that shows advanced information about a specific person?

SplunkTrust
SplunkTrust

Where is the error - in dashboard or search and whats the error?

0 Karma
Highlighted

Re: Can you help me make a drill down that shows advanced information about a specific person?

Communicator

When i click on name is opening a new page with err 404 and also Buttercup pony. Don't forget about Buttercup 🙂

Thnx.

0 Karma