Dashboard of Jobs

[raziasaduddin]

I want to create a dashboard that shows the completed runs of all scheduled searches and allows someone to click on them to view the results akin to what the jobs screen does.

Here is the query I have to display that:

| rest /services/search/jobs | search dispatchState="DONE" delegate="scheduler" | eval url="https://splunkserver:port/en-US/app/search/flashtimeline?sid="+sid

I want people to be able to click on the url field and get taken to that url.

[LukeMurphey · Accepted solution]

You should be able to do this in simple XML using the drilldown attribute with a link of /en-US/app/search/flashtimeline?sid=$row.sid$:

<table>
<title>Dashboard of Jobs </title>
    <searchString>| rest /services/search/jobs | search dispatchState="DONE" delegate="scheduler" | fields label sid </searchString>
<drilldown>
     <link>/en-US/app/search/flashtimeline?sid=$row.sid$ </link>
</drilldown>
 </table>

Please ignore that extra space on each of the tags. For the life of me, I cannot get Splunk-Base to list list the literal XML. See http://pastebin.com/Jf8eNqMF for a better version.

[LukeMurphey]

@Ayn: Thanks, that looks much better. It hadn't occurred to me that just the preview was broken.

[Ayn]

I fixed the formatting for you, hope that's OK. Unfortunately it seems the post preview removes tags even though it works just fine once you've submitted your post.