Dashboards & Visualizations

How to setup dashboard drilldown so clicked value in table will return results on the same page?

jeffreyjewitt
Explorer

Hi:

I will admit to getting confused with the advanced simple XML dashboarding.
I currently has a simple 3 form (1 textbox, 1 dropdown and time picker) dashboard that populates a table with data. You can then click on a value in the data, and the results will redirect you to the search app, fill in a query and start searching.
What I would love to have is that same 3 form simple dashboard, but have the results from clicking on a value in the data return below the table, not in a separate page or app.
I believe that this is possible, as it seems to be done by the splunk sos app (drop down for what splunk server to query, and a time picker), and below is a splunk search driven by data selected from a list box. I was looking at the source xml for the SOS app, and getting totally confused as to how it was working.

I've been looking at the documentation for the splunk dashboard_examples app, but it doesn't seem to show that usage case.

Does anyone have any idea if what I want to do is possible, and any tips as to how to go about achieving this?

Thanks for any assistance you could provide

-Jeff

Below is the current dashboard:

<form >

<label >Blah</label >

<fieldset >

    <input type="text" token="memberID" > 

        <label >MemberID</label > 

        <default >*</default > 

        <seed >*</seed > 

    </input >

    <input type="dropdown" token="transactionType" >

        <label >Select a Transaction Type</label >

        <choice value="*" >Any</choice >

    </input >

    <input type="time" token="dashboardTime" searchWhenChanged="true" >

        <label >Timeframe</label >

        <default >

            <earliestTime >@d</earliestTime >

            <latestTime >now</latestTime >

        </default >

    </input >

</fieldset >

<searchTemplate > 

    <seaerch > | stats count(transferID) by transferID | fields transferID

</searchTemplate >

<row >   

    <!-- show results as a table -- >

    <table >

        <option name="showPager" >true</option >

        <option name="count" >20</option >

        <option name="drilldown" >all</option >

            <drilldown >

            <link target="_blank" >

                <![CDATA[/app/search/flashtimeline?q=search%20h<search > $click.value$ earliest="$earliest$" latest="$latest$"]] >

            </link >

        </drilldown >

        <option name="drilldown" >row</option >

    </table >      

</row >

   </form >
1 Solution

akazarov
Path Finder

Yes this is possible.
1. Upgrade to splunk 6.1.3
2. Install Application "Splunk 6.x Dashboard Examples" (download archive and install in your instance)
3. Check "Contextual Drilldown (In-page)" example. It is pretty simple.

View solution in original post

ygkr
New Member

@akazarov

I saw that example but in my case I need to pass two token values as depends.

with one token its working but its not working for multiple token can u plz help in passing the multiple tokens.

0 Karma

akazarov
Path Finder

Yes this is possible.
1. Upgrade to splunk 6.1.3
2. Install Application "Splunk 6.x Dashboard Examples" (download archive and install in your instance)
3. Check "Contextual Drilldown (In-page)" example. It is pretty simple.

pradeepkumarg
Influencer

You can try

Sideviewutils - Gate module to achieve same page drill down

http://sideviewapps.com/apps/sideview-utils/

OR

If you are running Splunk 6.x you can make use of web framework to develop interactive views.

You can download Web Framework Tool Kit examples from apps.splunk.com

http://apps.splunk.com/app/1613/

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...