Dashboards & Visualizations

Dashboard of Jobs

raziasaduddin
Path Finder

I want to create a dashboard that shows the completed runs of all scheduled searches and allows someone to click on them to view the results akin to what the jobs screen does.

Here is the query I have to display that:

| rest /services/search/jobs | search dispatchState="DONE" delegate="scheduler" | eval url="https://splunkserver:port/en-US/app/search/flashtimeline?sid="+sid

I want people to be able to click on the url field and get taken to that url.

Tags (4)
0 Karma
1 Solution

LukeMurphey
Champion

You should be able to do this in simple XML using the drilldown attribute with a link of /en-US/app/search/flashtimeline?sid=$row.sid$:

<table>
<title>Dashboard of Jobs </title>
    <searchString>| rest /services/search/jobs | search dispatchState="DONE" delegate="scheduler" | fields label sid </searchString>
<drilldown>
     <link>/en-US/app/search/flashtimeline?sid=$row.sid$ </link>
</drilldown>
 </table>

Please ignore that extra space on each of the tags. For the life of me, I cannot get Splunk-Base to list list the literal XML. See http://pastebin.com/Jf8eNqMF for a better version.

View solution in original post

LukeMurphey
Champion

You should be able to do this in simple XML using the drilldown attribute with a link of /en-US/app/search/flashtimeline?sid=$row.sid$:

<table>
<title>Dashboard of Jobs </title>
    <searchString>| rest /services/search/jobs | search dispatchState="DONE" delegate="scheduler" | fields label sid </searchString>
<drilldown>
     <link>/en-US/app/search/flashtimeline?sid=$row.sid$ </link>
</drilldown>
 </table>

Please ignore that extra space on each of the tags. For the life of me, I cannot get Splunk-Base to list list the literal XML. See http://pastebin.com/Jf8eNqMF for a better version.

LukeMurphey
Champion

@Ayn: Thanks, that looks much better. It hadn't occurred to me that just the preview was broken.

0 Karma

Ayn
Legend

I fixed the formatting for you, hope that's OK. Unfortunately it seems the post preview removes tags even though it works just fine once you've submitted your post.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...