Dashboards & Visualizations

How to create drilldown from a table column to display a chart in another dashboard using advanced xml?

vaishnavi07
Explorer

I am displaying a table with running processes and few metrics. If the user clicks on any column then the column's name should get passes to another dashboard which displays graph. below is the code which displays the table,






False
1


splunk.search.job
True
1


dashboard










Type System Name

stringreplace



host=
True




span
datetime

  <module name="SubmitButton">
    <param name="allowSoftSubmit">True</param>
    <param name="label">Search</param>
    <!-- End Header -->
    <!-- Begin Modules -->

     <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Running Processes (Point-in-Time)" autoRun="False">
      <param name="search"> $computername$ index=winserver_process earliest=`ChangeTime("$datetime$","-3m")` latest=`ChangeTime("$datetime$","+3m")` NOT instance=Idle NOT instance=_Total | dedup source,instance | eval instance=Upper(instance) | stats first(*) AS * by instance | join host type=outer [search index=winserver_config $computername$ sourcetype=WMI:SysInfo earliest=-14d@d latest=now | dedup host | fields host,NumberOfLogicalProcessors] | eval "% Processor Time"=round(if(isint(NumberOfLogicalProcessors),'%_Processor_Time'/NumberOfLogicalProcessors,'%_Processor_Time'),1) | eval "Private Bytes (MB)"=round('Private_Bytes'/1024/1024,2) | eval "Working Set (MB)"=round('Working_Set'/1024/1024,2) | eval "Write Ops/sec"=round('IO_Write_Operations/sec',2) | eval "Read Ops/sec"=round('IO_Read_Operations/sec',2) | eval "Page Faults/sec"=round('Page_Faults/sec',2) | eval Handles=round(Handle_Count,2) | eval Threads=round(Thread_Count,2) | eval "Elapsed Time"=round(Elapsed_Time,0) | eval "ID Process"=round(ID_Process,0) | rename instance AS Process | fields Process "% Processor Time" "Private Bytes (MB)" "Working Set (MB)" "Page Faults/sec" "Write Ops/sec" "Read Ops/sec" "Handles" "Threads" "ID Process" "Elapsed Time" | fillnull </param>
      <module name="JobProgressIndicator" />
      <module name="EnablePreview">
        <param name="display">False</param>
        <module name="Count">
          <param name="options">
            <list>
              <param name="text">10</param>
              <param name="selected">True</param>
              <param name="value">10</param>
            </list>
            <list>
              <param name="text">20</param>
              <param name="value">20</param>
            </list>
            <list>
              <param name="text">50</param>
              <param name="value">50</param>
            </list>
          </param>
          <module name="MSPager">
            <param name="entityName">results</param>
            <module name="FilterableResultsTable">
              <param name="displayRowNumbers">off</param>
                </param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>      
  </module>
</module>


Thanks in advance.

0 Karma

dounla2carlos
Explorer

I think that is not possible yet with splunk

0 Karma

vaishnavi07
Explorer

I have added the Simple Drilldown module and now the view is navigating to anither dashboard but the instance value is not getting passed.

         <param name="links">
           <param name="*">
           /app/ms_reap_sh_server/Cpu-new?instance=11
   </param>
         </param>    
       </module>

Can anyone help me on this?

0 Karma

kmattern
Builder

Have you considered using Sideview Utils? Since you are using Advanced.XML (and good for you for doing so) if you are not using Sideview Utils you are missing out on the best tool for the job. With Sideview you can pass one or more arguments from your results table to a new dashboard and it is easy to do. The documentation will help you get exactly what you want in minutes.

for example, this code, will pass the field from the MODEL column from the row you clicked to a new dashboard named ModelSales

<module name="Redirector">
  <param name="arg.MDS">$row.fields.MODEL$</param>
  <param name="target">_blank</param>
  <param name="url">ModelSales</param>
</module>
0 Karma

vaishnavi07
Explorer

No its another dahsboard which should display the graph for top five processes for the metric that user selects in the table.

0 Karma

hagjos43
Contributor

By "another dashboard" do you mean a different panel within the same dashboard?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...