Dashboards & Visualizations

Simple XML: custom drill down with passing clicked field to new search

the_wolverine
Champion

I'm looking for an answer using Simple XML.

I know how to do this with Advanced XML, but how can it be done using Simple XML?

I have a table (or chart) that I click on and want the click value (or values) to be passed on to a new search. Basically I want to do things like use summary data (or stats) and pass them on to a raw data search for additional context.

The 6.x Dashboard examples don't cover this scenario.

the_wolverine
Champion

All the examples I've reviewed show how to to pass a clicked value to a link (another form, another website, etc). So far I don't see any examples of how to do pass a clicked value to a new search -- opening a new pop up window -- target = _blank...)

0 Karma

MuS
SplunkTrust
SplunkTrust

Okay, unless I completely misunderstood the question, try something like this :

<dashboard>
  <label>click test</label>
  <row>
    <panel>
      <table>
        <title>search</title>
        <search>
          <query>index=_internal | chart count by sourcetype</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>

        <drilldown target="_blank">
            <link>
                <![CDATA[
                /app/search/search?q=search%20$click.value2$
                ]]>
            </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

the_wolverine
Champion

Ok, that is kind of cheating but it works. 🙂 Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...