Dashboard drilldown: user clicks on value, search is ran on that value, value from this search opens a new web page

[matansocher]

Hi,

I need to create a drilldown for my dashboard. I need to give the ability to the user to click on a value, and then run a new query and use the value that returned from the query to open a new web page with the value returned from the new query.

example:
I have the following table:

I want to exclude the "Drilldown ID" field from the table, and give the user the option to click on a record and another web page will be opened. I need the "Drilldown ID" field to be in the url of the new web page opened, but I dont want it in my table results.

Is that possible?

Thanks

[niketn · Accepted solution]

@matansocher, Splunk 6.x Dashboard Examples App has "Table Element with Hidden Fields" example which explains the exact use case. @cmerriman has taken Splunk Simple XML configuration which lets you do this. However, if you want to hide a table field and still use the same for drilldown, you should try the following two steps:

Step 1: Use fieldsin Simple XML to remove "Drilldown ID" from being displayed in the table.

<fields>["ID", "Queue", "Date Created"]</fields>

Step 2: Use predefined table token $row.$ for <drilldown>

$row.Drilldown ID$

Following is a run anywhere dashboard with mocked data and drilldown to URL just to display the token in a new browser window.

<dashboard>
  <label>Table hide field use in drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval "Drilldown ID"="somehexguid12ab1234",ID="INC1234567",Queue="Windows","Date Created"="2017-06-13"
| append 
    [| makeresults
     | eval "Drilldown ID"="somehexguid45cd4321",ID="INC7654321",Queue="HW","Date Created"="2017-06-19"]
| table "Drilldown ID", "ID", "Queue", "Date Created"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <fields>["ID", "Queue", "Date Created"]</fields>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">http://answers.splunk.com/$row.Drilldown ID$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

[matansocher]

Thank you!!

[cmerriman]

This is definitely possible!

add something like this to your source code after the </search> tag:

 <drilldown>
          <link target="_blank">URL with token like this $row.drilldownid$</link>
        </drilldown>

you might want to add a new field that copies drilldown id for the token.
|eval drilldownid='Drilldown ID' or something similar in your search
you can use this in your source code to not include it in your panel (also after the </search> tag)

<fields>["Drilldown ID","ID","Queue","Date Created"]</fields>

[matansocher]

I have managed to do this with that way, but I need my table not to include the field "Drilldown ID".
I want to look for it in another search and then open a new web page with that value.

[cmerriman]

Oh, I'm sorry, I missed that there was a search in between this one and the webpage.
for drilldown reference:
http://docs.splunk.com/Documentation/Splunk/6.6.3/Viz/EventHandlerReference#Drilldown_event_tokens
so for the first panel, if you're linking it to another panel in the dashboard, you could do something like:

   <drilldown>
          <set token="drilldownid">$row.drilldownid$</set>
   </drilldown>

and then in that panel, use $drilldownid$ in the search and set

<drilldown>
       <link target="_blank">URL with token like this $row.fieldname$</link>
 </drilldown>

if you want to hide the second panel before clicking on the Drilldown ID, you can add depends="$drilldownid$" in the <panel> tag of the second panel

[matansocher]

Thank you for your answer, it was really helpfull. I finally decided to use niketnilay's answer, it really simplified my needs.