Dashboards & Visualizations

How to create simple XML dashboard with contextual drilldown elements in Splunk 6?

cphair
Builder

Hi. I'm trying to create a simple XML dashboard with one table and a chart that takes a drilldown value from that table. http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/Understandbasictableandchartdrilldownactions describes what I want under "Contextual drilldown elements", but when I try to implement the drilldown as described in the first example, it simply takes me to the search bar when I click a table row. I looked at the Splunk 6 Dashboard Examples App, but the in-page drilldown with permalinking example requires CSS and JS, and it doesn't seem like that should be needed. Is there some parameter I'm missing that will tell it to stay on the current page and just load the extra chart?

EDIT: Here's the relevant code. I tried using click.value instead of row.site, but neither worked; nor did including the option for drilldown=row.







-5m
now





index=foo sourcetype=iis-access | eval Error=if(code>=400,1,0) | stats count as Volume sum(Error) as Errors avg(time_taken) as AvgTime max(time_taken) as Max_Time by site | eval AvgTime=round(AvgTime,1)
$earliest$
$latest$

$row.site$

true
false
none
10


Service levels for site $site$

<![CDATA[index=foo sourcetype=iis-access site=$site$ | eval ServiceLevel=case(0<=time_taken AND time_taken <2,"good",2<=time_taken AND time_taken <4,"warning",4<=time_taken,"unacceptable",1==1,"error") | chart count by ServiceLevel]]>




0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

Full examples are in these apps. I recommend upgrading to the 6.1.1 release as well.

Splunk 6.1 Overview:
https://apps.splunk.com/app/1773/

Simple XML Examples>
https://apps.splunk.com/app/1603/

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

Full examples are in these apps. I recommend upgrading to the 6.1.1 release as well.

Splunk 6.1 Overview:
https://apps.splunk.com/app/1773/

Simple XML Examples>
https://apps.splunk.com/app/1603/

cphair
Builder

Thanks for the clarifications. Unfortunately this isn't an instance I have control over upgrading, so I'll write it off for now.

0 Karma

nfilippi_splunk
Splunk Employee
Splunk Employee

Correct, in-page drilldown is a new feature in Splunk 6.1, whereby you can fully configure it in Simple XML without the requirement for custom js and css.

After upgrading to Splunk 6.1, I would recommend installing the latest Splunk 6.x Dashboard Examples app v2.0.1 as that includes the updated Simple XML-only example.

dmaislin_splunk
Splunk Employee
Splunk Employee

I haven't tested without the javascript and css in 6.x. I just found it easier to upgrade. Sorry I can't be of more assistance.

0 Karma

cphair
Builder

So in-page drilldown isn't supposed to work in simple XML in 6.0 without all the extras?

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

In 6.0.x the CSS and JS is extra. In 6.1 it is no longer required.

0 Karma

cphair
Builder

Hi @dmaislin_splunk. I already looked at these apps and noted in my question that the in-page example in the app required JS and CSS, and the docs imply that shouldn't be necessary. Is the doc I linked incorrect, or did I miss something in the implementation?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Do post the relevant SimpleXML code. There's nothing in particular to be careful about, so there's probably a simple mistake in there somewhere.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...