Dashboards & Visualizations

How to drop down selected table field data into a sub-panel?

rbardonetorian
Path Finder

Hello Splunksters,

I would like to select a row in my table and have it open a new panel under the originating panel with another output table only using the selected row criteria. How could I make this happen?

Currently, I see posts about dynamic -drill downs sending to template pages external pages, etc. I also see drill-down updating chart criteria in the docs and "answers" posts.. nothing helps me with my use case, using the tables.

Here is the originating panel code I am working with:

    <panel>
      <title>Activity</title>
      <table>
        <title>Activity</title>
        <search>
          <query>index="main" eventtype="special" NOT tag::eventtype=noise |  sort - _time|  table _time src_ip user name field</query>
          <earliest>$field3.earliest$</earliest>
          <latest>$field3.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">preview</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">false</option>
      </table>
    </panel>

I would like the "destination" "drop-down" panel to output to the same format table, simply with data comprised of the originating selection.

Thanks much for the help!!

(Simple XML is throwing me for a loop) :winking_face:

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

I believe what you need (based on your text before dashboard code in the question) is a contextual drilldown dashboard, examples of which can be found in this link.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Understandbasictableandchartdrilldownactions#C...

The text after the dashboard code in your question says "drop-down" which is confusing. Is it dropdown or drilldown??

View solution in original post

0 Karma

somesoni2
Revered Legend

I believe what you need (based on your text before dashboard code in the question) is a contextual drilldown dashboard, examples of which can be found in this link.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Understandbasictableandchartdrilldownactions#C...

The text after the dashboard code in your question says "drop-down" which is confusing. Is it dropdown or drilldown??

0 Karma

rbardonetorian
Path Finder

Thanks much! I believe that does help me. I cant believe I missed that..

Any pointers on setting the panel to a specific height ? ie 300 pixels?

Cheers!

0 Karma

rbardonetorian
Path Finder

Rock on!!!!! Thx!

0 Karma

rbardonetorian
Path Finder

I ran into a snag.. I am trying to send the contextual data to an "event panel". All the reference docs refer to "charting".
I am trying to set the following with no joy.

<event depends="$type_tok$">... serarch XML.. </event>

any ideas?

0 Karma

somesoni2
Revered Legend

It should work the same way it works for charts or any other visualization. Just check that syntax of event visualization is written correctly. See this
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#event

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...