I am trying to 'link' several panels on a dashboard to a single 'master' panel. A typical master-detail relationship with many details panels.
A more detailed cenario: We index several versions of the same software. We Would like a 'master' panel to select the version OR a text-field (like a view) to input the version number. That value of 'selected version' or 'version string', would be used for several other panels on that dashboard.
Several users would use/copy/customize the panel he would like to see on the dashboard.
I am new to splunk, found so much information that I simply dont know wich path to follow. Is there a way to do that using a custom dashboard? (didnt find any way to 'link') Or I must stick to PosProcess on forms? (As far as I read its very undesirable, expensive to maintaing, xml required to add/remove "panels", etc)
You'll need to use the Advanced XML syntax, and nest your dependent panel (modules) underneath the "master".
If you want some example code, take a look at the Indexing Volume dashboard in the search app. Adding showsource=1
to the URL will let you see the XML and the module structure:
http://127.0.0.1:8000/en-US/app/search/indexing_volume
http://127.0.0.1:8000/en-US/app/search/indexing_volume?showsource=1
For more example code, download and install the UI Examples app from SplunkBase:
http://splunkbase.splunk.com/apps/All/4.x/Add-On/app:UI+Examples
Also, take a look in the docs here, under Drilldown to a new Chart
http://www.splunk.com/base/Documentation/4.1.5/Developer/TableChartDrilldown#Advanced_examples