Dashboards & Visualizations

How do I drilldown each column to each sources?

appleman
Contributor

Hello,

I created a simple dashbaord, and am trying to set drilldown for each columns.
But the thing is, each column needs to drilldown to different searches.
Like as shown below, if I click "A", then it goes to sourcetype=A search, on the other hand, if I click "i", then it goes to sourcetype=i search.
Is it possible to do this?

Thanks in advance.


以下のダッシュボードのテーブルから、それぞれのカラムをクリックすると、それぞれ違うサーチ文にドリルダウンさせるということをしたいのですが、どのように設定すればいいのかご教示下さい。

alt text

0 Karma
1 Solution

melonman
Motivator

You need to add tag for yout result table, and spedify the link (or next view) with the clicked value.

 <drilldown>
  <link>
     /app/YOUR_APP/your_view?form.sourcetype=$click.value$
   </link>
 </drilldown> 

you really need to check the document to see what is passed by clicking on the result table.

View solution in original post

0 Karma

melonman
Motivator

You need to add tag for yout result table, and spedify the link (or next view) with the clicked value.

 <drilldown>
  <link>
     /app/YOUR_APP/your_view?form.sourcetype=$click.value$
   </link>
 </drilldown> 

you really need to check the document to see what is passed by clicking on the result table.

0 Karma

appleman
Contributor

Thank you, but I've already read this before, and couldn't find an answer. Each type needs to go different searches or dashboards, but I don't know how to do it.

0 Karma

cwl
Contributor
0 Karma

appleman
Contributor

It just goes to this page.

0 Karma

cwl
Contributor
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...