Dashboards & Visualizations
Highlighted

How to pass multiple values from a drilldown in a table to a separate dashboard?

Path Finder

Say I have a dashboard with a panel that generates a table of values and I want to be able to drill down on several values of the row when I click on one of the values within that row. How do you go about this using simple xml, and could I get an example?

Highlighted

Re: How to pass multiple values from a drilldown in a table to a separate dashboard?

Path Finder

You have to use the drilldown element as linked here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...

With the link value, you specify the separate view that you want the drilldown values to get passed to and then list out the values separated by "&".

The following two xml examples show how to set up drilldown options in one view, and how to accept them in the second view. This first view (we will call the dashboard "test1" will generate a table of values sourcetype, component, name and count. When you click on a value in the table, the sourcetype, component and name of that row will be sent to the second dashboard (we will call test2).

Dashboard xml for "test1" which has the drilldown table:

<dashboard>
  <label>test1</label>
  <description/>
  <row>
    <panel>
      <table>
        <title>Test for drilldown case</title>
        <searchString>index=_internal | stats count by sourcetype, component, name</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <drilldown>
          <link>
            <![CDATA[
              /app/search/test2?form.sourcetype=$row.sourcetype$&form.component=$row.component$&form.name=$row.name$
            ]]>
          </link>
        </drilldown>  
      </table>
    </panel>
  </row>
</dashboard>

Dashboard xml for "test2" which accepts the drilldown values passed from "test1" dashboard:

<dashboard>
  <label>test2</label>
  <description/>
  <row>
    <panel>
      <event>
        <title>drill down panel</title>
        <searchString>index=_internal sourcetype=$form.sourcetype$ component=$form.component$ name=$form.name$</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">0</option>
        <option name="dataOverlayMode">none</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</dashboard>

You will notice that the values get passed via the url and the search in the "test2" dashboard panel is populated with the values passed from the row clicked on in "test1".

View solution in original post

Highlighted

Re: How to pass multiple values from a drilldown in a table to a separate dashboard?

Path Finder

Wiggy, very nice example!!!!!!! I would have given you extra points but we are not allowed to.

Highlighted

Re: How to pass multiple values from a drilldown in a table to a separate dashboard?

Engager

Is there a way to pass multiple values on the same dashboard?

Highlighted

Re: How to pass multiple values from a drilldown in a table to a separate dashboard?

New Member

@algalvan Did you find a way to do this on the same dashboard?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.