Dashboards & Visualizations

Drilldown link in dashboard

Branden
Builder

I have a dashboard displaying various results (charts, single values, some raw output). The dashboard uses HiddenSavedSearches to get the results.

My understanding is that there is no way to drilldown from a SingleValue field. So I'd like to create a hyperlink near the SingleValue field that will link the user to the results of the search.

For example, here is part of the dashboard:

<module name="HiddenSavedSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
      <param name="savedSearch">Check XYZ</param>
      <param name="useHistory">Auto</param>
      <module name="HiddenPostProcess">
         <param name="search">search host="abc" | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                   <param name="field">yesno</param>
                   <param name="classField">range</param>
                   <param name="beforeLabel">XYZ:</param>
                </module>
           </module>
       </module>

I'd like the user to be able to either 1) click the SingleValue rectangle and view the search results or, if that is not possible, 2) click a nearby link to produce the detailed results. 

Ideally, clicking the link would not kick off a new search, but would simply use the results of the last HiddenSavedSearch.

Is this possible?

Thanks!

Tags (2)
0 Karma
1 Solution

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

View solution in original post

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

Branden
Builder

I ended up using the latter (link below without triggering a new search). Works like a charm, thanks so much!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...