Dashboards & Visualizations

Drilldown to Show Source

rwardwell
Explorer

Hello All,
I have a usecase to generate a drill down from a dashboard to the "Show Source" view. I am able to open a new tab that is the show source view but it is not populated. I think I need to try and pass the sid to the show source view. I tried to do this by setting a token to equal the job.sid. However, this token has a bunch of other data such as username etc and doesn't work. Does anyone have experience linking to show source and if so how did you do it?

Thanks!

Tags (2)
0 Karma

ak9092
Path Finder

Hi @rwardwell ,

Have you had any luck in achieving this ? If yes, then can you please share your inputs as I am struggling with the same.

0 Karma

niketn
Legend

@rwardwell @ak9092 how about something like this? You have to ensure that Dashboard search for drilldown has raw events only using purely streaming command.

<dashboard>
  <label>Table with Show Source Drilldown</label>
  <search>
    <query>| makeresults
    | eval app="$env:app$"</query>
    <done>
      <set token="app">$result.app$</set>
    </done>
  </search>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <set token="sid">$job.sid$</set>
          </done>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| fields _time log_level _raw
| head 50</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">http://localhost:8000/en-US/app/$app$/show_source?sid=$sid|n$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...