Dashboards & Visualizations

Simple XML: custom drill down with passing clicked field to new search

the_wolverine
Champion

I'm looking for an answer using Simple XML.

I know how to do this with Advanced XML, but how can it be done using Simple XML?

I have a table (or chart) that I click on and want the click value (or values) to be passed on to a new search. Basically I want to do things like use summary data (or stats) and pass them on to a raw data search for additional context.

The 6.x Dashboard examples don't cover this scenario.

the_wolverine
Champion

All the examples I've reviewed show how to to pass a clicked value to a link (another form, another website, etc). So far I don't see any examples of how to do pass a clicked value to a new search -- opening a new pop up window -- target = _blank...)

0 Karma

MuS
Legend

Okay, unless I completely misunderstood the question, try something like this :

<dashboard>
  <label>click test</label>
  <row>
    <panel>
      <table>
        <title>search</title>
        <search>
          <query>index=_internal | chart count by sourcetype</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>

        <drilldown target="_blank">
            <link>
                <![CDATA[
                /app/search/search?q=search%20$click.value2$
                ]]>
            </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

the_wolverine
Champion

Ok, that is kind of cheating but it works. 🙂 Thanks.

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 3)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...