I am trying to execute the example of "In-Page Drilldown with Perma-linking" in splunk 6.0,
"index=_internal | stats count by sourcetype"
When I click on any sourcetype it doesn’t reflect anything in Detail but when I type specifically in the sourcetype section,it gives the output for the query in Detail
index=_internal sourcetype=$sourcetype$ | timechart count
do i need to put the scripts inpage_drilldown_form.css and inpage_drilldown_form.js need to be in any specific folder.
I have it currently in /etc/apps/search/appserver/static. But the example drilldown that I try doesn’t seem to work.
erase import in your xml code and
rename those two files as dashboard.js and dashboard.css.
it worked for me couple weeks ago. I think reason behind, it is not working as it was in "Splunk 6 Dashboard Examples" is caused by Splunk Versions. By being not sure, this thing comes with Splunk 6 that script files that you modify in app folder, overrides actual css / js that splunk uses.
Converting those js/css files to dashboard.js and dashboard.css will result in those files being loaded on every Simple XML dashboard. Not sure that that is what you want here.
As of Splunk 6, Simple XML now supports both app-level as well as page-level customizations via JS/CSS.
- App-level: All Simple XML dashboards will load dashboard.js and dashboard.css if these files exist within your appserver/static/ directory
- Page-level: You have the option load custom js/css for that specific page by explicitly including it in your top-level xml element.
After copying those files into place, did you restart splunk?
Have you verified that these scripts are being loaded with the page (using the browser inspector)? In Chrome, you can:
You can also verify whether this file is available:
Thanks nfilippi. The restarting of splunk has done the trick. It works for other fields but if I use source instead of sourcetype like "index=_internal | stats count by source", the source are getting listed as source="C:\Program Files\Splunk\var\log\splunk\first_install.log" but the drilldown seems to be blank with "No results found". Do you think any additional setting is required for windows source.