Dashboards & Visualizations

Data log on dashboard

sonasingh147
New Member

I currently have a table on my dashboard that filters specific fields from my data log and when you click on a specific field of table it opens the log on a new web page. Is there a way I can open the data log under my table on the dashboard?

0 Karma

somesoni2
Revered Legend

What you're speaking of is called "In-page" OR "Contextual" drilldown. The Splunk 6.x Dashboard example app has examples of that under "Drilldown element". https://splunkbase.splunk.com/app/1603/

For your reference, the example code is this (run anywhere code, works on 6.2,6.3,6.4 version

<form>
    <label>In-Page Drilldown with Perma-linking</label>
    <fieldset submitButton="false">
        <!--
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
         -->
        <input type="text" token="sourcetype" searchWhenChanged="true"/>
    </fieldset>
    <row>
        <table id="master">
            <title>Master</title>
            <search>
                <query>index=_internal | stats count by sourcetype</query>
                <earliest>-60m@m</earliest>
                <latest>now</latest>
            </search>
            <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
            <option name="drilldown">row</option>
            <drilldown>
                <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
                <set token="sourcetype">$row.sourcetype$</set>
                <!-- If we also set the form.sourcetype the input will get updated too -->
                <set token="form.sourcetype">$row.sourcetype$</set>
            </drilldown>
        </table>
    </row>
    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <chart id="detail" depends="$sourcetype$">
            <title>Detail: $sourcetype$</title>
            <search>
                <query>index=_internal sourcetype=$sourcetype$ | timechart count</query>
                <earliest>-60m@m</earliest>
                <latest>now</latest>
            </search>
        </chart>
    </row>
</form>

sundareshr
Legend

See if this gives you any ideas. Create an events panel to drilldown to

http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Dynamicdrilldownindashboardsandforms

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...