Dashboards & Visualizations

Data log on dashboard

sonasingh147
New Member

I currently have a table on my dashboard that filters specific fields from my data log and when you click on a specific field of table it opens the log on a new web page. Is there a way I can open the data log under my table on the dashboard?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What you're speaking of is called "In-page" OR "Contextual" drilldown. The Splunk 6.x Dashboard example app has examples of that under "Drilldown element". https://splunkbase.splunk.com/app/1603/

For your reference, the example code is this (run anywhere code, works on 6.2,6.3,6.4 version

<form>
    <label>In-Page Drilldown with Perma-linking</label>
    <fieldset submitButton="false">
        <!--
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
         -->
        <input type="text" token="sourcetype" searchWhenChanged="true"/>
    </fieldset>
    <row>
        <table id="master">
            <title>Master</title>
            <search>
                <query>index=_internal | stats count by sourcetype</query>
                <earliest>-60m@m</earliest>
                <latest>now</latest>
            </search>
            <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
            <option name="drilldown">row</option>
            <drilldown>
                <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
                <set token="sourcetype">$row.sourcetype$</set>
                <!-- If we also set the form.sourcetype the input will get updated too -->
                <set token="form.sourcetype">$row.sourcetype$</set>
            </drilldown>
        </table>
    </row>
    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <chart id="detail" depends="$sourcetype$">
            <title>Detail: $sourcetype$</title>
            <search>
                <query>index=_internal sourcetype=$sourcetype$ | timechart count</query>
                <earliest>-60m@m</earliest>
                <latest>now</latest>
            </search>
        </chart>
    </row>
</form>

sundareshr
Legend

See if this gives you any ideas. Create an events panel to drilldown to

http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Dynamicdrilldownindashboardsandforms

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...