Hi:
I will admit to getting confused with the advanced simple XML dashboarding.
I currently has a simple 3 form (1 textbox, 1 dropdown and time picker) dashboard that populates a table with data. You can then click on a value in the data, and the results will redirect you to the search app, fill in a query and start searching.
What I would love to have is that same 3 form simple dashboard, but have the results from clicking on a value in the data return below the table, not in a separate page or app.
I believe that this is possible, as it seems to be done by the splunk sos app (drop down for what splunk server to query, and a time picker), and below is a splunk search driven by data selected from a list box. I was looking at the source xml for the SOS app, and getting totally confused as to how it was working.
I've been looking at the documentation for the splunk dashboard_examples app, but it doesn't seem to show that usage case.
Does anyone have any idea if what I want to do is possible, and any tips as to how to go about achieving this?
Thanks for any assistance you could provide
-Jeff
Below is the current dashboard:
<form >
<label >Blah</label >
<fieldset >
<input type="text" token="memberID" >
<label >MemberID</label >
<default >*</default >
<seed >*</seed >
</input >
<input type="dropdown" token="transactionType" >
<label >Select a Transaction Type</label >
<choice value="*" >Any</choice >
</input >
<input type="time" token="dashboardTime" searchWhenChanged="true" >
<label >Timeframe</label >
<default >
<earliestTime >@d</earliestTime >
<latestTime >now</latestTime >
</default >
</input >
</fieldset >
<searchTemplate >
<seaerch > | stats count(transferID) by transferID | fields transferID
</searchTemplate >
<row >
<!-- show results as a table -- >
<table >
<option name="showPager" >true</option >
<option name="count" >20</option >
<option name="drilldown" >all</option >
<drilldown >
<link target="_blank" >
<![CDATA[/app/search/flashtimeline?q=search%20h<search > $click.value$ earliest="$earliest$" latest="$latest$"]] >
</link >
</drilldown >
<option name="drilldown" >row</option >
</table >
</row >
</form >
Yes this is possible.
1. Upgrade to splunk 6.1.3
2. Install Application "Splunk 6.x Dashboard Examples" (download archive and install in your instance)
3. Check "Contextual Drilldown (In-page)" example. It is pretty simple.
@akazarov
I saw that example but in my case I need to pass two token values as depends.
with one token its working but its not working for multiple token can u plz help in passing the multiple tokens.
Yes this is possible.
1. Upgrade to splunk 6.1.3
2. Install Application "Splunk 6.x Dashboard Examples" (download archive and install in your instance)
3. Check "Contextual Drilldown (In-page)" example. It is pretty simple.
You can try
Sideviewutils - Gate module to achieve same page drill down
http://sideviewapps.com/apps/sideview-utils/
OR
If you are running Splunk 6.x you can make use of web framework to develop interactive views.
You can download Web Framework Tool Kit examples from apps.splunk.com