Dashboards & Visualizations
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
Solved! Jump to solution

How to get Splunk to link to different dashboards depending on the extracted field value from the table drilldown in Simple XML?

alex1895
Path Finder
‎02-08-2016 04:50 PM

I want Splunk to link to different dashboards depending on the extracted field value it got from the table drilldown.

Is it possible to solve via Simple XML?

Alex

0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

s2_splunk
Splunk Employee
Splunk Employee
‎02-08-2016 08:24 PM

Hi alex1895,
the snippet below is taken from the Splunk 6.x Dashboard Examples App, spcifically the "Drilldown Elements->Dynamic Drilldown" section.
alt text

Adjust the link URL to the view you want to navigate to and use $token$ values from your source view as needed.

View solution in original post

Preview file
102 KB
0 Karma
Reply
Solved! Jump to solution

bandit
Motivator
‎11-20-2018 10:56 AM

Drilldown example of a row click dynamically generating a URL based on field values in the row. Either absolute or relative links should work using Link to custom URL in the Drilldown Editor. I'm running Splunk 7.1

     <drilldown>
       <link target="_blank">/app/$row.app$/$row.title$</link>
     </drilldown>

Sample Dash:

  <form>
  <label>Dashboard Explorer v2</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="app" searchWhenChanged="true">
      <label>App</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>app</fieldForLabel>
      <fieldForValue>app</fieldForValue>
      <search>
        <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search NOT (app="*TA-*" OR app="*SA-*" OR app="*_TA_*") 
| table app 
| dedup app 
| sort app</query>
        <earliest>-5m</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="title" searchWhenChanged="true">
      <label>Title</label>
      <fieldForLabel>title</fieldForLabel>
      <fieldForValue>title</fieldForValue>
      <search>
        <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search NOT (app="*TA-*" OR app="*SA-*" OR app="*_TA_*") 
| table title 
| dedup title
| sort title</query>
        <earliest>-5m</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
    <input type="dropdown" token="author" searchWhenChanged="true">
      <label>Author</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>author</fieldForLabel>
      <fieldForValue>author</fieldForValue>
      <search>
        <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search NOT (app="*TA-*" OR app="*SA-*" OR app="*_TA_*") 
| table author 
| dedup author 
| sort author</query>
        <earliest>-5m</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="text" token="key_word" searchWhenChanged="true">
      <label>Key Word</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Dashboards</title>
      <single>
        <search>
          <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search app="$app$" title="$title$" author="$author$" (app="*$key_word$*" OR title="*$key_word$*" OR author="*$key_word$*") NOT (app="*TA-*" OR app="*SA-*" OR app="*_SA_*" OR app="*_TA_*" OR app="Splunk_ML_Toolkit" OR app="splunk_monitoring_console" OR app="
    unix-indexer-props") 
| table app title author type 
| stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <title>Top App</title>
      <table>
        <search>
          <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search app="$app$" title="$title$" author="$author$" (app="*$key_word$*" OR title="*$key_word$*" OR author="*$key_word$*") NOT (app="*TA-*" OR app="*SA-*" OR app="*_SA_*" OR app="*_TA_*" OR app="Splunk_ML_Toolkit" OR app="splunk_monitoring_console" OR app="
    unix-indexer-props") 
| table app title author type 
| top app 
| eval percent=round(percent,1)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="app">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="title">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="author">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="type">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <title>Top Author</title>
      <table>
        <search>
          <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search app="$app$" title="$title$" author="$author$" (app="*$key_word$*" OR title="*$key_word$*" OR author="*$key_word$*") NOT (app="*TA-*" OR app="*SA-*" OR app="*_SA_*" OR app="*_TA_*" OR app="Splunk_ML_Toolkit" OR app="splunk_monitoring_console" OR app="
    unix-indexer-props") 
| table app title author type 
| top author 
| eval percent=round(percent,1)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="app">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="title">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="author">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="type">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Dashboard List</title>
      <table>
        <title>click row to launch dashboard</title>
        <search>
          <query>| rest /servicesNS/-/-/data/ui/views 
| table author title eai:acl.app 
| eval type="Dashboard" 
| rename eai:acl.app as app 
| search app="$app$" title="$title$" author="$author$" (app="*$key_word$*" OR title="*$key_word$*" OR author="*$key_word$*") NOT (app="*TA-*" OR app="*SA-*" OR app="*_SA_*" OR app="*_TA_*" OR app="Splunk_ML_Toolkit" OR app="splunk_monitoring_console" OR app="
    unix-indexer-props") 
| table app title author type 
| sort app title</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">false</option>
        <format type="color" field="app">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="title">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="author">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="type">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <drilldown>
          <link target="_blank">/app/$row.app$/$row.title$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>
0 Karma
Reply
Solved! Jump to solution
Solution

s2_splunk
Splunk Employee
Splunk Employee
‎02-08-2016 08:24 PM

Hi alex1895,
the snippet below is taken from the Splunk 6.x Dashboard Examples App, spcifically the "Drilldown Elements->Dynamic Drilldown" section.
alt text

Adjust the link URL to the view you want to navigate to and use $token$ values from your source view as needed.

Preview file
102 KB
0 Karma
Reply
Solved! Jump to solution

alex1895
Path Finder
‎02-08-2016 09:15 PM

Thanks for the reply. I am not really sure if that is the answer to my question. I know how to use Dynamic Drilldown, I just want to include a value check before exercising the drilldown. Depending on that value the dynamic drilldown would go to different places.

0 Karma
Reply
Solved! Jump to solution

s2_splunk
Splunk Employee
Splunk Employee
‎02-08-2016 10:52 PM

I think you are sure that it is not, and I am sorry for misunderstanding your question. 🙂
This probably better describes your use case, if I get it now and I think the answer given there is accurate. You will likely have to convert to a HTML dashboard and implement your conditional logic in JavaScript.

Or maybe your use case allows you to follow the approach described here, but that depends on whether you can map your conditions to a dashboard view naming convention.

Is that more in line with what you need?

Reply
Solved! Jump to solution

alex1895
Path Finder
‎02-09-2016 11:18 AM

Great thanks the second one work out.

0 Karma
Reply
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...