Dashboards & Visualizations

Drilldown on event annotation?

Graham_Hanningt
Builder

I've started using event annotations in Splunk 7.3.0.

I'm successfully displaying event annotations for transactions that "abended" (abnormally ended) overlaid on a time chart of all transactions. (If transactions that abended sounds odd, think: events that failed.)

The time chart already has the charting.drilldown option set to all. If a bar in the time chart is overlaid with one or more annotations, clicking that bar shows a search table of all transactions for that bar, including transactions that abended. Since I'm familiar with the data and its fields, I can adjust the search to show me only the transactions that abended. But not all users will be that familiar with the data.

I'd like users to be able to click an event annotation and see the search results for that specific event. Is that possible via Simple XML? If not, how difficult would that be to implement in bespoke code?

haph
Path Finder

Any solution for this? 

I would like to do the same

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...