Dashboards & Visualizations

Dynamically pass SPL to events panel on dashboard

dstuder
Communicator

I have a dashboard with four pie charts across the top. I've set up drill downs for these that open up a new tab. However, I'm wondering if it is possible to put and events panel below them and depending upon the pie chart that is clicked dynamically build the SPL for the events panel. The four pie charts have very different searches and drill downs, so I cannot simply just populate some tokens for use with the events panel. I would need to actually dynamically build the SPL and pass that to the events panel. Is that even possible? Thanks.

Labels (2)
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Please see below the code of simple XML dashboard:

- I've used table as below panels instead of events, but you could use events.

- In my case all data are generated with makeresults command for testing.

<dashboard>
  <label>Test_Dashboard</label>
  <row>
    <panel>
      <title>1</title>
      <single>
        <search>
          <query>| makeresults | eval count="1" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>2</title>
      <single>
        <search>
          <query>| makeresults | eval count="2" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>3</title>
      <single>
        <search>
          <query>| makeresults | eval count="3" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>4</title>
      <single>
        <search>
          <query>| makeresults | eval count="4" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>Events panel</title>
      <table>
        <search>
          <query>$events_panel_spl$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

- See use of <drilldown> and <set> with single view and I've generated the whole SPL inside the token and I'm then just using that token ($events_panel_spl$) as whole search query.

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Please see below the code of simple XML dashboard:

- I've used table as below panels instead of events, but you could use events.

- In my case all data are generated with makeresults command for testing.

<dashboard>
  <label>Test_Dashboard</label>
  <row>
    <panel>
      <title>1</title>
      <single>
        <search>
          <query>| makeresults | eval count="1" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>2</title>
      <single>
        <search>
          <query>| makeresults | eval count="2" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>3</title>
      <single>
        <search>
          <query>| makeresults | eval count="3" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>4</title>
      <single>
        <search>
          <query>| makeresults | eval count="4" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>Events panel</title>
      <table>
        <search>
          <query>$events_panel_spl$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

- See use of <drilldown> and <set> with single view and I've generated the whole SPL inside the token and I'm then just using that token ($events_panel_spl$) as whole search query.

0 Karma

dstuder
Communicator

Odd. I tried that first and it wasn't working. I must have had something wrong with the syntax that I was not seeing. Anyway, thanks. That is doing what I want.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...