Dashboards & Visualizations

Drilldown link in dashboard

Branden
Builder

I have a dashboard displaying various results (charts, single values, some raw output). The dashboard uses HiddenSavedSearches to get the results.

My understanding is that there is no way to drilldown from a SingleValue field. So I'd like to create a hyperlink near the SingleValue field that will link the user to the results of the search.

For example, here is part of the dashboard:

<module name="HiddenSavedSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
      <param name="savedSearch">Check XYZ</param>
      <param name="useHistory">Auto</param>
      <module name="HiddenPostProcess">
         <param name="search">search host="abc" | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                   <param name="field">yesno</param>
                   <param name="classField">range</param>
                   <param name="beforeLabel">XYZ:</param>
                </module>
           </module>
       </module>

I'd like the user to be able to either 1) click the SingleValue rectangle and view the search results or, if that is not possible, 2) click a nearby link to produce the detailed results. 

Ideally, clicking the link would not kick off a new search, but would simply use the results of the last HiddenSavedSearch.

Is this possible?

Thanks!

Tags (2)
0 Karma
1 Solution

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

View solution in original post

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

Branden
Builder

I ended up using the latter (link below without triggering a new search). Works like a charm, thanks so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...