Dashboards & Visualizations

How do I set drilldown if I want to set several pages to go?

appleman
Contributor

Hello there,

I want to set drilldown on the dashboard attached below, but how can I set if I want to set several token?
Here is what I want to do;
If you click the column "InstallProfile" under command, it goes to the page which its search is "source=xxx".
Or if you click the column "EnrollDevice", it goes to another page which its search is "source=yyy".

Please give me some advice.

Thank you.


添付のテーブル上で、"InstallProfile"をクリックすると、"source=xxx"が設定されているページに遷移し、他のコマンド、(例:"EnrollDevice")をクリックすると、今度は"source=yyy"というページに遷移するようにドリルダウンを設定したい場合、どのように設定したらよいのでしょうか。

alt text

0 Karma
1 Solution

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

View solution in original post

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

appleman
Contributor

Thank you! Your query helped me a lot!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...