Dashboards & Visualizations

How do I display the collection of events (as a drill down) present inside a transaction by clicking on the row (transaction table) in the main dashboard.

Explorer

I want to display all the events present inside a transaction on the main dashboard by clicking on the transaction row in the table , but I am not able to return that specific transaction events and instead returning all the transactions related to that source.

So essentially, I need to see all the events present inside the clicked row (transactions) in the form of a drill down of events.
Can someone point me in the right direction please.
Thank you.

0 Karma
1 Solution

Legend

Hi pkol,
could you share your search?
Anyway, I suggest to create two panels in a dashboard, in the main panel you insert your search.
Then you can pass as token/s the field/s you used to create your transaction to the secondary panel and display the events that are in the transaction.
To know how to pass a token from a panel to another in the same dashboard, see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Anyway, if you created your transaction using a field as transaction id, I suggest to explore a different approach because the transaction command is very slow!
e.g. if you have something like this

index=my_index
| transaction trans_id
| table _time trans_id field1 field2

you can change in

index=my_index
| stats earliest(_time) AS _time values(field1) AS field1 values(field2) AS field2 count BY trans_id

that is very faster than the other.

Bye.
Giuseppe

View solution in original post

Legend

Hi pkol,
could you share your search?
Anyway, I suggest to create two panels in a dashboard, in the main panel you insert your search.
Then you can pass as token/s the field/s you used to create your transaction to the secondary panel and display the events that are in the transaction.
To know how to pass a token from a panel to another in the same dashboard, see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Anyway, if you created your transaction using a field as transaction id, I suggest to explore a different approach because the transaction command is very slow!
e.g. if you have something like this

index=my_index
| transaction trans_id
| table _time trans_id field1 field2

you can change in

index=my_index
| stats earliest(_time) AS _time values(field1) AS field1 values(field2) AS field2 count BY trans_id

that is very faster than the other.

Bye.
Giuseppe

View solution in original post

Explorer

THANK YOU , I FIGURED IT OUT!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!