Dashboards & Visualizations

Base search to use in a new window as a drilldown dashboard

Nadhiya123
Explorer

Hello All,

Is there a way to put a base search in the first dashboard which drilldowns to a new dashboard where it uses the base search from the first dashboard.

0 Karma

niketn
Legend

@Nadhiya123, how many base searches are being passed from one dashboard to another? What may vary in your base searches. Can you give examples of base search from first dashboard?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Nadhiya123
Explorer

@niketn

There is one search which i use to display a map in my first dashboard.

it drilldowns to the new next dashboard based on the lat/lon,

base search in 1st map dashbaord:
......
.......| stats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG
| geostats max(sessions) as sessions, max(X) as X, max(Y) as Y latfield=LAT longfield=LNG outputlatfield=LAT outputlongfield=LNG globallimit=0 | eval High_No_Of_Calls = if(sessions > $HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <= $Medium$,sessions,0)
| fields - sessions, X, Y

drilldown search 1:
.........
......| stats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG | eval High_No_Of_Calls = if(sessions > $HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <=$Medium$,sessions,0) | fields - sessions, X, Y| where LAT>=$lattitude1$ AND LAT<$lattitude2$ AND LNG>=$longitude1$ AND LNG<$longitude2$|table NPANXX,High_No_Of_Calls,Medium_No_Of_Calls,Normal_No_Of_Calls|where (High_No_Of_Calls=$High$ AND Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$) |head 1|eval High_No_Of_Calls=$High$|eval Medium_No_Of_Calls=$Med$|eval Normal_No_Of_Calls=$Normal$|table NPANXX,High_No_Of_Calls,Medium_No_Of_Calls,Normal_No_Of_Calls

drilldownsearch 2:

| eventstats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG | eval High_No_Of_Calls = if(sessions >$HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <=$Medium$,sessions,0) | fields - sessions, X, Y| where LAT>=$lattitude1$ AND LAT<$lattitude2$ AND LNG>=$longitude1$ AND LNG<$longitude2$
|table _time,....|where (High_No_Of_Calls=$High$ AND Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$) OR (Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$)|sort - _time|eval m=max($High$,$Med$,$Normal$) | streamstats c | where c<=m|table ....
Trying to work on the performance issue.

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Nadhiya123,
you can pass as token a search from the first dashboard to the second but only if it's not so long because there are limits to url lenght.
Anyway do you want to pass a fixed search or a different one depending by the click on the first dashboard panel?
Maybe you could create secondary dashboard search passing as token only parameters.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...