Dashboards & Visualizations

Dynamically pass SPL to events panel on dashboard

dstuder
Communicator

I have a dashboard with four pie charts across the top. I've set up drill downs for these that open up a new tab. However, I'm wondering if it is possible to put and events panel below them and depending upon the pie chart that is clicked dynamically build the SPL for the events panel. The four pie charts have very different searches and drill downs, so I cannot simply just populate some tokens for use with the events panel. I would need to actually dynamically build the SPL and pass that to the events panel. Is that even possible? Thanks.

Labels (2)
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Please see below the code of simple XML dashboard:

- I've used table as below panels instead of events, but you could use events.

- In my case all data are generated with makeresults command for testing.

<dashboard>
  <label>Test_Dashboard</label>
  <row>
    <panel>
      <title>1</title>
      <single>
        <search>
          <query>| makeresults | eval count="1" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>2</title>
      <single>
        <search>
          <query>| makeresults | eval count="2" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>3</title>
      <single>
        <search>
          <query>| makeresults | eval count="3" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>4</title>
      <single>
        <search>
          <query>| makeresults | eval count="4" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>Events panel</title>
      <table>
        <search>
          <query>$events_panel_spl$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

- See use of <drilldown> and <set> with single view and I've generated the whole SPL inside the token and I'm then just using that token ($events_panel_spl$) as whole search query.

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Please see below the code of simple XML dashboard:

- I've used table as below panels instead of events, but you could use events.

- In my case all data are generated with makeresults command for testing.

<dashboard>
  <label>Test_Dashboard</label>
  <row>
    <panel>
      <title>1</title>
      <single>
        <search>
          <query>| makeresults | eval count="1" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>2</title>
      <single>
        <search>
          <query>| makeresults | eval count="2" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>3</title>
      <single>
        <search>
          <query>| makeresults | eval count="3" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>4</title>
      <single>
        <search>
          <query>| makeresults | eval count="4" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>Events panel</title>
      <table>
        <search>
          <query>$events_panel_spl$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

- See use of <drilldown> and <set> with single view and I've generated the whole SPL inside the token and I'm then just using that token ($events_panel_spl$) as whole search query.

0 Karma

dstuder
Communicator

Odd. I tried that first and it wasn't working. I must have had something wrong with the syntax that I was not seeing. Anyway, thanks. That is doing what I want.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...