Dashboards & Visualizations

How to control drilldown on dashboard chart click?

clairebesson
Explorer

Hey everyone,
I have a graph as shown in the figure below :
alt text

Server1 and Server2 are two different sources.
For now I did this drilldown :
<drilldown target="_What - Track Up Aps">

      <condition field="Up">
        <link>
      /app/search/what__track_up_aps?form.Up=$click.value$
    </link>
      </condition>
      <condition field="Down">
   <link>
      /app/search/what__track_down_aps?form.Down=$click.value$
    </link>
      </condition>


  </drilldown>

When you click on Up you go on the dashboard at the address : /app/search/what__track_up_aps?

And when you click on Down you go on the dashboard at the address :
/app/search/what__track_down_aps?

However, I want to do that:
- When I click on Up from Server1 I go on dashboard1
- When I click on Up from Server2 I go on dashboard2

  • When I click on Down from Server1 I go on dashboard3
  • When I click on Down from Server2 I go on dashboard4

I don’t know how to put a condition on “Server1” or “Server2”
Could you please help me with that ?
Thanks in advance

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Your top produces three fields, Type count percent. Yet, you're telling the input to look for labels and values in the source field... which does not exist in your top results.

0 Karma

clairebesson
Explorer

thanks. So I tried to add a dropdown on which I can choose to display server 1 or server 2.
I looked at the example on app Splunk 6x Dashboard Examples. There is a dropdown with different sourcetype.
I did the same but it didn't work. In my case the dropdown permit to choose between different sources (server1.csv and server2.csv)

<input type="dropdown" token="source" searchWhenChanged="true">
  <label>Select a source:</label>
  <prefix>source="</prefix>
  <suffix>"</suffix>
  <choice value="*">All</choice>
  <search>
    <query>source=airwave* Status=Down| top limit=20 Type</query>
  </search>
  <fieldForLabel>source</fieldForLabel>
  <fieldForValue>source</fieldForValue>
</input>
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yeah, add form fields at the top to select the server and pre-populate this with the value from the drilldown.

0 Karma

clairebesson
Explorer

sorry I am a newbie in Splunk. I do not know at all how to do that.
could you please help me with that ?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you sure you want different dashboards for each server instead of passing the server name as a parameter to the same dashboard?

0 Karma

clairebesson
Explorer

you mean to have one dashboard for the Up. On that dashboard I create a menu in order to choose which server I want to display ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...