I need to create a drilldown for my dashboard. I need to give the ability to the user to click on a value, and then run a new query and use the value that returned from the query to open a new web page with the value returned from the new query.
I have the following table:
I want to exclude the "Drilldown ID" field from the table, and give the user the option to click on a record and another web page will be opened. I need the "Drilldown ID" field to be in the url of the new web page opened, but I dont want it in my table results.
Is that possible?
This is definitely possible!
add something like this to your source code after the
<drilldown> <link target="_blank">URL with token like this $row.drilldownid$</link> </drilldown>
you might want to add a new field that copies drilldown id for the token.
|eval drilldownid='Drilldown ID' or something similar in your search
you can use this in your source code to not include it in your panel (also after the
<fields>["Drilldown ID","ID","Queue","Date Created"]</fields>
I have managed to do this with that way, but I need my table not to include the field "Drilldown ID".
I want to look for it in another search and then open a new web page with that value.
Oh, I'm sorry, I missed that there was a search in between this one and the webpage.
for drilldown reference:
so for the first panel, if you're linking it to another panel in the dashboard, you could do something like:
<drilldown> <set token="drilldownid">$row.drilldownid$</set> </drilldown>
and then in that panel, use
$drilldownid$ in the search and set
<drilldown> <link target="_blank">URL with token like this $row.fieldname$</link> </drilldown>
if you want to hide the second panel before clicking on the Drilldown ID, you can add
depends="$drilldownid$" in the
<panel> tag of the second panel
Thank you for your answer, it was really helpfull. I finally decided to use niketnilay's answer, it really simplified my needs.
Splunk 6.x Dashboard Examples App has "Table Element with Hidden Fields" example which explains the exact use case. @cmerriman has taken Splunk Simple XML configuration which lets you do this. However, if you want to hide a table field and still use the same for drilldown, you should try the following two steps:
Step 1: Use
fieldsin Simple XML to remove
"Drilldown ID" from being displayed in the table.
<fields>["ID", "Queue", "Date Created"]</fields>
Step 2: Use predefined table token $row.$ for
Following is a run anywhere dashboard with mocked data and drilldown to URL just to display the token in a new browser window.
<dashboard> <label>Table hide field use in drilldown</label> <row> <panel> <table> <search> <query>| makeresults | eval "Drilldown ID"="somehexguid12ab1234",ID="INC1234567",Queue="Windows","Date Created"="2017-06-13" | append [| makeresults | eval "Drilldown ID"="somehexguid45cd4321",ID="INC7654321",Queue="HW","Date Created"="2017-06-19"] | table "Drilldown ID", "ID", "Queue", "Date Created"</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <fields>["ID", "Queue", "Date Created"]</fields> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <link target="_blank">http://answers.splunk.com/$row.Drilldown ID$</link> </drilldown> </table> </panel> </row> </dashboard>