Dashboards & Visualizations

How could I custom the Link to search but still using the value from the clicked element?

Jennifer
Path Finder

Hi, all! 

I am want to custom the search command when I click the element but I don't know how to write the search using values from the clicked element like Auto function. 

Jennifer_0-1643255136728.png

For example, here's my dashboard and I hope that when I click on one of the Call_Session_ID, then it will jump to the search which combines the four different times with the same Call_Session_ID.

Jennifer_1-1643255471026.png

Thanks a lot for your help!

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @Jennifer,

let me understand:

  • you have a table that lists some values,
  • clicking on one of these rows you want to open a new dashboard (or a new panel) with a different search (or the same) passing the clicked value to the search for filtering results;

is this correct?

If this is your need, I think that you should install on your Splunk machine the "Splunk Dashboard Examples " App (https://splunkbase.splunk.com/app/1603/) where you can find examples about how to do this.

in few words, if you want to open a new dashboard (called e.g. "details"), passing to it the clicked Call_Session_ID value, you could do somethiung like this:

In the main dashboard, add to the panel:

<option name="drilldown">cell</option>
<drilldown>
   <link target="_blank">/app/your_app/details?Call_Session_ID=$row.Call_Session_ID$&amp;</link>
</drilldown>

and in the secondary dashboard, add to the search the token $Call_Session_ID$:

your_search Call_Session_ID=$Call_Session_ID$
| ...

Ciao.

Giuseppe

View solution in original post

SinghK
Builder

You will need to create that search separately and save it as dashboard. Once done then edit the XML where the element is and add the link to the dashboard in XML.

<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">/app/your_app/details?Call_Session_ID=$row.Call_Session_ID$&amp;</link>
</drilldown>

 

0 Karma

gcusello
Legend

Hi @Jennifer,

let me understand:

  • you have a table that lists some values,
  • clicking on one of these rows you want to open a new dashboard (or a new panel) with a different search (or the same) passing the clicked value to the search for filtering results;

is this correct?

If this is your need, I think that you should install on your Splunk machine the "Splunk Dashboard Examples " App (https://splunkbase.splunk.com/app/1603/) where you can find examples about how to do this.

in few words, if you want to open a new dashboard (called e.g. "details"), passing to it the clicked Call_Session_ID value, you could do somethiung like this:

In the main dashboard, add to the panel:

<option name="drilldown">cell</option>
<drilldown>
   <link target="_blank">/app/your_app/details?Call_Session_ID=$row.Call_Session_ID$&amp;</link>
</drilldown>

and in the secondary dashboard, add to the search the token $Call_Session_ID$:

your_search Call_Session_ID=$Call_Session_ID$
| ...

Ciao.

Giuseppe

Jennifer
Path Finder

Hi, Giuseppe!

Firstly, thanks so much for your help and I've solved this problem.  I just use the token of the click value in my custom search of drilldown!

Secondly I want to ask help with another issue:

How could I edit my search command in order to filter this table which will only display the first row of the same value(Call_Session_ID)? It means it will only show one Call_Session_ID with the earliest Time. 

Here is my original search command:

index="hkcivr" source="/appvol/wlp/DIVR01HK-AS01/applogs/progresshk.log*" $tttt$ $key$| table Time Call_Session_ID

Jennifer_0-1643352323310.png

 

 

0 Karma

gcusello
Legend

Hi @Jennifer,

good for you, please accept the answer for the other people of Community.

About the new question, next time it's better to open a new question.

But anyway, it's possible but only putting in a multivalue field all the values for the same Call_Session_ID, something like this:

index="hkcivr" source="/appvol/wlp/DIVR01HK-AS01/applogs/progresshk.log*" $tttt$ $key$
| stats values(Time) AS Time BY Call_Session_ID

 Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

SinghK
Builder

This needs to be updated xml :

<drilldown>
<link target="_self">/put in the link to which it needs to be redirected to</link>
</drilldown>

0 Karma

johnhua
Builder

Do you want the clicked on token/value to run a search in the current dashboard or open a new tab to a different search/dashboard?

0 Karma

Jennifer
Path Finder

I hope to open a new tap and show the result which uses the selected element!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...