Is there a way to link multiple dashboards from an existing dashboard?

[Kumar1980]

HI ,

I was able to create and link two dashboards with your assistance earlier and that was really helpful!

Currently i have a new requirement and need some assistance

Current setup :
Dashboard1 has a column chart with n number of servers. Once i click on any of them, it leads me to Dashboard2 which has a column representation of various/specific logs from all the servers belonging to the same pool. Selecting the required log leads me to the search page.

Now here is the new requirement :
From Dashboard1, if i click on a server from n servers, i need to be redirected to another dashboard which has logs related to that specific server only (i can create the dashboard, that should not be a problem).

Clicking on the specific log should take me to the search page with results.

My Question :

Is there any way we can link multiple dashboards from Dashboard1 ? (one dashboard (Dashboard1) linked to multiple dashboards for every individual server)

The number of servers in Dashboard is > 15 and wanted to know if this is a feasible request. If Yes, how do i achieve it?

I have tried creating a dashboard (Dashboard2) with multiple panels representing the servers, however it was ruled out.

Please suggest

-Praneeth

[ralcindor]

I have this question that i need to asked: i have 4 dashboards that i need to combine together, don't how to do it please help.

[richgalloway]

This question is almost 3 years old with an accepted answer so it's effectively "closed". Please submit a new question.

[gcusello · Accepted solution]

Hi Kumar1980,
I'm not sure to have correctly understand your questions:

• You have a dashboard with many servers,
• clicking on one of them you drilldown in another different dashboard with all the events of that server, correct?
• then clicking on one log of the second dashboard you want to open the search dashboard with the search parameters chosen with the click, correct?

if these are your need you have to configure the first drilldown as you already know and the second one using the "search" dashboard, something like this

<drilldown>
   <link>
       <![CDATA[search?tag1=$row.host&TimeDa=$Time.earliest$&TimeA=$Time.latest$]]>
    </link>
</drilldown>

Note: I inserted in the url parameters also the time period to have the same one also in the drilldown dashboard

Bye.
Giuseppe

[Kumar1980]

HI Giuseppe,

Thanks for the response

1) I have a dashboard with many servers
2) clicking on one of them i drilldown in another different dashboard with all the events from all the servers in first dashboard (logs are not specific to the server that i click, they are from all the servers in the 1st dashboard)
3) Clicking the specific i will go to the search page

I need that if i click on a server the second dashboard should have a column chart with specific logs pertaining to that particular server only

So i will need to link multiple dashboards with the first one which are related to individual servers listed in the first dashboard

I wanted to know if it is possible to link multiple dashboards (>15) with the first one, if yes then how do i achieve it

First and third steps are not a problem i am concerned only with the second point 🙂

• Praneeth

[gcusello]

Sorry, but I continue to not understand:
in the first dashboard, you have logs from all the servers in a table in which every row is the count for one server,
clicking on a row you drilldown in a second dashboard filtered by the clicked server and you want to show all the events of the clicked server, correct?

I don't understand why you want to drilldown in the second dashboard with events from all the servers.

Everyway if you want to have in a dashboard all the events of all servers, you can use the same search you used in the first dashboard, but instead of a stats command you have to use a table command.

Bye.
Giuseppe

[Kumar1980]

HI,

Reply inline :
in the first dashboard, you have logs from all the servers in a table in which every row is the count for one server,
clicking on a row you drilldown in a second dashboard filtered by the clicked server and you want to show all the events of the clicked server, correct? - Yes

I don't understand why you want to drilldown in the second dashboard with events from all the servers. - i did not know how do i drill down for all individual servers so used the current view as an alternate, if drill down for individual servers is possible this is no longer needed

As per my understanding if i had to link a dashboard to other i had to add a link under the drilldown tag with in the chart. I do not know if adding multiple links will work or not

The current requirement needs a column chart representation so just wanted to know if it is possible to link multiple dashboards form the first one, representing one dashboard for each individual server ?

• Praneeth

[gcusello]

Hi Praneeth ,
To drilldown in another dashboard you have to create a second dashboard in which, in every search you insert the used tag (your_search $host$ | ...).
then in the first dashboard you have to insert in every panel the following rows

<link>
    <![CDATA[your_dashboard?host=$row.host&amp;TimeDa=$Time.earliest$&amp;TimeA=$Time.latest$]]>
 </link>

In this way, clicking on a row you pass the three tokens (host, earliest and latest) to the second dashboard.
Remember to put in the second dashboard, in every search the following rows:

  <earliest>$TimeDa$</earliest>
  <latest>$TimeA$</latest>

In this way you pass from the main dashboard to the second one: host, earliest and latest.

You don't need to have different dashboard for each server, but only one.

If you like, but I usually don't do this, you can use the search app as the second dashboard: for me it's better to build a second dashboard with only the columns (fields) I need.

Bye.
Giuseppe

[Kumar1980]

Thanks Cusello,

I will try it and get back to you if i face any issues

If possible i'll try to upload the code that i used

• Praneeth

[Kumar1980]

HI Cusello,

I guess i have confused with what i was looking for , sorry for that and appreciate your time 🙂

Let me make simple and clear on what i need

Dashboard 1: number of errors/exceptions/timeouts (minus false alerts) grouped by hostname.

I have created this dashboard and have no issues with it (getting the desired results)

When I click on the hostname from Dashboard1 it should take me Dashboard2
Dasbhoard2: messages grouped by sourcetype, only for that host which i clicked (not across hosts).

This is where i am facing issues, i am not sure how do i link 1st and 2nd dashboard based on the hostnames

Please note that i am using a chart option and grouped the results in a column chart sorted host wise and looking for the same with Dashboard2 grouped by sourcetype

I am new to this so troubling you 🙂 The implementation is crucial for my ongoing project request you to help on this

• Praneeth

[gcusello]

Hi Praneeth ,
I confirm that the way to obtain what you want is the one described in my previous comment:

1. create first dashboard inserting the rows with drilldown and link;
2. insert in in each search of the second dashboard the tokens (host, TimeDa and TimeA) as described.

at this point you'll have your drilldown.
There is only one additional information you need: if you'r creating a drilldown from a table you can use $row.host$, if instead your creating a drilldown from a chart you have to use a different token creation ($click.value$).
You can find rules to create your drilldown are at http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens

In addition I suggest to you to download and installa the Splunk 6.x Dashboarda Examples Dashboard (https://splunkbase.splunk.com/app/1603/) in which is fully describes how to build a drilldown and other examples in dashboard building.

Bye.
Giuseppe

[Kumar1980]

HI Giuseppe,

I tried the suggestion that you gave however i am not sure if i am doing it right as i face errors

Here is the code for 1st dashboard and second dashboard is : en-US/app/search/test_new_parpr14

I get a page not found

Secure5-Backend errors/exceptions - Last one hour
Shows the errors/exceptions across secure5 in the callout logs from all s5 tridents

<panel>
       <chart>
    <search>
      <query>index=*  host=* source="/logs/odslogs/*" AND ("ERROR" OR "exception" OR "timeout")| rex "(?&lt;err&gt;ERROR|exception|timeout)" | chart usenull=f count over host by err</query>
      <earliest>@d</earliest>
      <latest>now</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">stacked</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
    <option name="charting.legend.placement">top</option>
    <drilldown>
                  <set token="host">$click.value2$</set>
      <link>en-US/app/search/test_new_parpr14</link>
    </drilldown>
  </chart>
</panel>

Can you please help me out with the code ?

[Kumar1980]

and just a point to add .. i only have one panel in the 1st dashboard

[gcusello]

you have to modify the rows of drilldown:

<drilldown>
   <link>
      <![CDATA[test_new_parpr14?host=$row.host$&amp;TimeDa=$Time.earliest$&amp;TimeA=$Time.latest$]]>
   </link>
</drilldown>

be attention to the following items:

• for the token host: try with $click.value2$ that is usually used in charts, but if you have a table you have to use $row.host$;

• if you haven't a Time Picker to modify time input, you don't need to insert TimeDa and TimeA Tokens, so you have:

  
  
  <![CDATA[test_new_parpr14?host=$row.host$]]>
  
  

Sorry but I don't reach to save code.

Bye.
Giuseppe

[Kumar1980]

Thanks a ton Giuseppe,

it works !!!

Appreciate your time and help

• Praneeth
  

[gcusello]

I try again

<drilldown>
    <link>
       <![CDATA[test_new_parpr14?host=$row.host$]]>
    </link>
 </drilldown>

this should work!
Bye.
giuseppe

[gcusello]

Hi Praneeth ,
in the second dashboard, you must insert the token in your search

your_search host=$host$ | ...

beware to write the token identical (upper/lower) to the one of the main dashboard.

About the parameter, in drilldown from a table, I usually use host=$row.host$.

Bye.
Giuseppe

[Kumar1980]

HI Giuseppe,

The dashboards are working partially , thanks for the help

After clicking one server (column) on Dashboard1 i get to Dashboard2, however i get the soucetypes from all the servers listed

in Dashboard2 I want the sourcetypes to be charted only for the server that i click

Let me what parameters that i need to insert to make this work, i am using $click.value2$ in Dashboard1

Let me know if you want to look at the code

Please suggest

• Praneeth

[Kumar1980]

One more point wanted to add here

If i use i get the below error

XML Syntax Error: Cannot mix with explicit s (line 39)

[Kumar1980]

*condition

[Kumar1980]

HI There,

Can anyone pls update if there is a solution to the requirement provided

• Praneeth