Dashboards & Visualizations

Drilldown link in dashboard

Branden
Builder

I have a dashboard displaying various results (charts, single values, some raw output). The dashboard uses HiddenSavedSearches to get the results.

My understanding is that there is no way to drilldown from a SingleValue field. So I'd like to create a hyperlink near the SingleValue field that will link the user to the results of the search.

For example, here is part of the dashboard:

<module name="HiddenSavedSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
      <param name="savedSearch">Check XYZ</param>
      <param name="useHistory">Auto</param>
      <module name="HiddenPostProcess">
         <param name="search">search host="abc" | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                   <param name="field">yesno</param>
                   <param name="classField">range</param>
                   <param name="beforeLabel">XYZ:</param>
                </module>
           </module>
       </module>

I'd like the user to be able to either 1) click the SingleValue rectangle and view the search results or, if that is not possible, 2) click a nearby link to produce the detailed results. 

Ideally, clicking the link would not kick off a new search, but would simply use the results of the last HiddenSavedSearch.

Is this possible?

Thanks!

Tags (2)
0 Karma
1 Solution

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

View solution in original post

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

Branden
Builder

I ended up using the latter (link below without triggering a new search). Works like a charm, thanks so much!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...