Dashboards & Visualizations

When implementing the link to a search in a dashboard drilldown, can you help me configure the "auto" feature?

damucka
Builder

Hello,

I would like to implement the drilldown in my panel with the "Link to a Search". The "Auto" option seems to be a good choice as it generates the proper search with filters. There is, however, one thing I am not able to overcome there — I do not see any possibility to open the drilldown in the new tab window. It seems to be possible only in the "Custom" drilldown mode. This is quite an issue for me because when the drilldown opens in the same web tab, then by coming back to the main dashboard all the panels get refreshed, which I do not want.

Is there any possibility to get the "Auto" drilldown with the link to search opening in the new web tab?

I workaround it at the moment using the "Custom" mode, but then I have to work with tokens to get a proper search — I would rather let the "Auto" mode do the job instead.

Kind Regards,
Kamil]

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I don't think that's possible at the moment without coding a JS extension because the place SimpleXML dashboard panels store the "open in new tab" config is an attribute of the link element inside the drilldown element - that link element is used for specifying a custom link to a dashboard, search, or 3rd party URL.
https://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/PanelreferenceforSimplifiedXML#link

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I don't think that's possible at the moment without coding a JS extension because the place SimpleXML dashboard panels store the "open in new tab" config is an attribute of the link element inside the drilldown element - that link element is used for specifying a custom link to a dashboard, search, or 3rd party URL.
https://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/PanelreferenceforSimplifiedXML#link

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Check out these docs: http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/PanelreferenceforSimplifiedXML#chart_2

$earliest$ $latest$ will be the time range clicked, pass that into your search to zoom into that minute.
$click.value2$ should be the host value clicked, pass that into your search to filter for that host.

From memory it should be something like this: <link target="_blank">search?earliest=$earliest$&amp;latest=$latest$&amp;q=index=mlbso sourcetype=$SYSID$_abaptraces ABAPERROR=* host=$click.value2|s$</link>

0 Karma

damucka
Builder

Thank you.
Instead of $click.value2$ I had to use the $click.name2$ and it works fine.
BR, Kamil

0 Karma

damucka
Builder

Hello,

Thank you.
It looked to me so when checking the SimpleXML, but I wanted to confirm it.

In that case perhaps you can help me with the following:
- I have a panel with the search where I want to list the errors per host in the last 24 hours:

index=mlbso sourcetype=$SYSID$_abaptraces ABAPERROR=*
 | timechart count by host span=1m

Now I want to create the Custom Drilldown with the Link to Search that is working the same way the "Auto" does, meaning when I click on the chart point it will bring me to the events of that particular host and particular time span of 1 minute.
How would I achieve that? What tokens would I have to set and how the custom search would have to look like?

Kind Regards,
Kamil

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!