Dashboards & Visualizations

Open a search drilldown in new window

rsawant
Explorer

I'm creating a series of dashboards such that one navigates to the other on clicking a visualization. I referred to the questions asked here previously, and added the following to my simple XML dashboards:

<drilldown target="_blank">
<link>
/app/app_name/view_name?earliest=$field1.earliest$&latest=$field1.latest$
</link>
</drilldown>

Now, this works just fine.

The drilldown of the last dashboard in the series, however, must direct the user to a search window with the events related to the visualisation, exactly like the default drill down in dashboards, but in a new window. I tried adding this:

<drilldown target="_blank">
<link></link>
</drilldown>

but it doesn't work. Please help me open the default drill down in a new window. Thanks!!

0 Karma

gdiogo
Explorer

No solution in Simple XML ! 😞
So the only solution is to do the following :
You copy the url of the default drilldown after letting it run once.
Then you create your own custom drilldown, simple adapted copy of the default drilldown :

<drilldown target="_blank">
     <link target="_black">
            <![CDATA[
                  /app/xxxxxxxxxx/search?q=search%20sourcetype%20%3D%20xxxxxxxxx%20AP_NAME%3D%22$row.AP_NAME$%22%20INTERFERER_TYPE%3D%22$row.INTERFERER_TYPE$%22%20LAST_SEEN%3D%22$row.LAST_SEEN$%22%20RSSI%3D%22$row.RSSI$%22%20CLUSTER_ID%3D%22$row.CLUSTER_ID$%22%20%7C%20fields%20INTERFERER_TYPE%2C%20LAST_SEEN%2C%20RSSI%2C%20CLUSTER_ID%2C%20AP_NAME%20&earliest=$earliest$&latest=$latest$&display.page.search.mode=verbose&dispatch.sample_ratio=1
                 ]]>
              </link>
            </drilldown>

Based on the following default drilldown :

https://xxxxxxxxxxxxxxxxxxxxx/fr-FR/app/xxxxxxxxx/search?q=search%20sourcetype%20%3D%xxxxxxxxxx%20AP...

The trick is to simply replace the specific values of the default drilldown instance with the dynamic token : For each field, the $row.NAMEOFFIELD$ and $earliest$ and $latest$ for the timerange !
Please go check out the official doc if you find my explanation too unclear !

Happy Splunking 😛

0 Karma

dounla2carlos
Explorer

Hi. I did something that could inspire you. Firt install this app "Dashbord6 example" then create a dashboard with my source code.enter code here

<dashboard>
  <label>Dynamic Drilldown</label>
  <description>Chart and Table panels with dynamic drilldown to custom destination links</description>
  <row>
   <chart>
   <title>Chart panel with dynamic drilldown that passes the clicked Y-axis token to a form.</title>
   <searchString>index=_internal | head 100 | chart count by sourcetype</searchString>
   <option name="charting.chart">line</option>
   <drilldown target="_blank">
    <link>/app/simple_xml_examples/simple_form_text?form.limit=$click.value2$</link>
   </drilldown>
    </chart>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...