Dashboard for Wineventlogs with Inbuilt Information

[anandhalagaras1]

Hi Team, 

I have created a dashboard with the below mentioned query and the output would be in Column chart format with a timer. And the output would display the Top 10 Event Codes with Count when we choose the time and click submit.

index=windows host=* source=WinEventLog:System EventCode=* Type=Error OR Type=Critical | stats count by EventCode Type |sort -count | head 10

So post the results are displayed in the Column chart then my requirement is that if we click any one of the EventCode  consider as an example of 4628 from the Top 10 details in the Column Chart then it should  navigate to a new panel or a window showing up with the Top 10 host, source, Message, EventCode along with Count for Event Code 4628. So something like that we want to get the results displayed. 

But this should happen if we click the EventCode from the Column chart of the existing dashboard.

Example:

index=windows host=* source=WinEventLog:System EventCode=4628 Type=Error OR Type=Critical | stats count by host source Message EventCode |sort -count | head 10

So kindly let me know how to achieve this requirement in a dashboard format.

[gcusello]

Hi @anandhalagaras1,

you should install in your Splunk the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603).

One of the examples is just what you're searching: the In page Drilldown.

Ciao.

Giuseppe