Dashboards & Visualizations

How do I set drilldown if I want to set several pages to go?

appleman
Contributor

Hello there,

I want to set drilldown on the dashboard attached below, but how can I set if I want to set several token?
Here is what I want to do;
If you click the column "InstallProfile" under command, it goes to the page which its search is "source=xxx".
Or if you click the column "EnrollDevice", it goes to another page which its search is "source=yyy".

Please give me some advice.

Thank you.


添付のテーブル上で、"InstallProfile"をクリックすると、"source=xxx"が設定されているページに遷移し、他のコマンド、(例:"EnrollDevice")をクリックすると、今度は"source=yyy"というページに遷移するようにドリルダウンを設定したい場合、どのように設定したらよいのでしょうか。

alt text

0 Karma
1 Solution

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

View solution in original post

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

appleman
Contributor

Thank you! Your query helped me a lot!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...