Hello Splunksters,
I would like to select a row in my table and have it open a new panel under the originating panel with another output table only using the selected row criteria. How could I make this happen?
Currently, I see posts about dynamic -drill downs sending to template pages external pages, etc. I also see drill-down updating chart criteria in the docs and "answers" posts.. nothing helps me with my use case, using the tables.
Here is the originating panel code I am working with:
<panel>
<title>Activity</title>
<table>
<title>Activity</title>
<search>
<query>index="main" eventtype="special" NOT tag::eventtype=noise | sort - _time| table _time src_ip user name field</query>
<earliest>$field3.earliest$</earliest>
<latest>$field3.latest$</latest>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">preview</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
</table>
</panel>
I would like the "destination" "drop-down" panel to output to the same format table, simply with data comprised of the originating selection.
Thanks much for the help!!
(Simple XML is throwing me for a loop) 😉
I believe what you need (based on your text before dashboard code in the question) is a contextual drilldown dashboard, examples of which can be found in this link.
The text after the dashboard code in your question says "drop-down" which is confusing. Is it dropdown or drilldown??
I believe what you need (based on your text before dashboard code in the question) is a contextual drilldown dashboard, examples of which can be found in this link.
The text after the dashboard code in your question says "drop-down" which is confusing. Is it dropdown or drilldown??
Thanks much! I believe that does help me. I cant believe I missed that..
Any pointers on setting the panel to a specific height ? ie 300 pixels?
Cheers!
See this
https://answers.splunk.com/answers/223644/how-to-limit-panel-height.html
Search for keywork "height" here for more info.
Rock on!!!!! Thx!
I ran into a snag.. I am trying to send the contextual data to an "event panel". All the reference docs refer to "charting".
I am trying to set the following with no joy.
<event depends="$type_tok$">... serarch XML.. </event>
any ideas?
It should work the same way it works for charts or any other visualization. Just check that syntax of event
visualization is written correctly. See this
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#event