Dashboards & Visualizations

How to see each event separately in Dashboard?

Renunaren
Loves-to-Learn Everything

I have a dashboard with column visualisation for the bars which Error, Success and Running event count details. I need to see the each events such as Error events seperately, Success events seperately, Running events seperately on clicking those bar charts. Need help on how to edit the drill downs.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you using Dashboard Studio or SimpleXML?

What do you have in your dashboard so far?

How do you want to display the details? In a separate window or additional panels in the same window?

0 Karma

Renunaren
Loves-to-Learn Everything

Additional panels in the same window

 

0 Karma

Renunaren
Loves-to-Learn Everything

I am using a simple xml dashboard like below

Capture-XML.PNG

In the above column chart the green one indicates the success event count while the same with the blue one for running events count and the same yellow for the waiting events.

I want to edit a drill down in a same page of the dashboard by clicking on the above columns it has to show the events which has been created in the form of a table in the same dashboard

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can do something along these lines. $click.name2$ is the name of the series clicked, the drilldown conditionally sets up some tokens to enable to the display of the details panels

  <row>
    <panel>
      <chart>
        <search>
          <query>| makeresults count=1000
| eval state=mvindex(split("Running,Success,Wait",","),-1+floor(log(random()%1000,10)))
| eval x=random()%5
| eval value=random()%10
| chart sum(value) by x state</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition match="$click.name2$=&quot;Running&quot;">
            <set token="showrunning"></set>
            <set token="valuer">$click.value$</set>
          </condition>
          <condition match="$click.name2$=&quot;Success&quot;">
            <set token="showsuccess"></set>
            <set token="values">$click.value$</set>
          </condition>
          <condition match="$click.name2$=&quot;Wait&quot;">
            <set token="showwait"></set>
            <set token="valuew">$click.value$</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$showrunning$">
      <table>
        <search>
          <query>| makeresults count=1000
| eval state=mvindex(split("Running,Success,Wait",","),-1+floor(log(random()%1000,10)))
| eval x=random()%5
| eval value=random()%10
| where state="Running" AND value=$valuer$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel depends="$showsuccess$">
      <table>
        <search>
          <query>| makeresults count=1000
| eval state=mvindex(split("Running,Success,Wait",","),-1+floor(log(random()%1000,10)))
| eval x=random()%5
| eval value=random()%10
| where state="Success" AND value=$values$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel depends="$showwait$">
      <table>
        <search>
          <query>| makeresults count=1000
| eval state=mvindex(split("Running,Success,Wait",","),-1+floor(log(random()%1000,10)))
| eval x=random()%5
| eval value=random()%10
| where state="Wait" AND value=$valuew$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...