how to link two dashboards in splunk 6.2

[sunnyparmar]

Hi,

I have two different dashboards one for disk space usage and other for memory and CPU utilization for two different hosts. I want to link them so that if i select one host in drill down so automatically its shows me the other KPI values also so is there any way to do this. Please give your valuable suggestions.

Thanks

[parimalan]

Hi Team ,

Can we able to link two different dashboard by using dashboard input ? if yes how to do it

Thanks

[richgalloway]

@parimalan This thread is more than two years old so it's unlikely your question will be seen. Please post a new question describing your problem.

[renjith_nair]

From your example, you are trying to do drill down in same panel on same table unless you haven't pasted complete code. You can have only one drill down per table as far as I know.

If its a second table, please make sure that you have a page host_overview and it's using a token src_type_tok.

Interestingly, there is no sourcetype field in any of your searches (probably complete xml is not pasted here)

So , there should be a page per_host_kpis and should have a src_type_tok token and there should be another page host_overview also with src_type_tok token

[sunnyparmar]

thanks for the answer but still not able to get it clear.. could you have some code that you have implemented on your side so can you share it please?

Thanks

[renjith_nair]

From the first dashboard(source) , I take sourcetype from the table and pass it to target dashboard.

    <dashboard>
      <label>Source </label>
      <row>
        <panel>
          <table>
            <title>Sourcetypes</title>
            <search>
              <query>index=*|stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
            </search>
            <option name="wrap">undefined</option>
            <option name="rowNumbers">undefined</option>
            <option name="drilldown">row</option>
            <drilldown>
              **<link>/app/search/target?form.sourcetype=$row.sourcetype$</link>**
            </drilldown>
          </table>
        </panel>
      </row>
    </dashboard>

In the target dashboard I am using the token in my search

<dashboard>
  <label>Target</label>
  <row>
    <panel>
      <table>
        <title>Details</title>
        <search>
          <query>index=* sourcetype=**$form.sourcetype$**</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</dashboard>

And from target I can drilldown to another page, and so on. If you want to call back the source page from target, make sure that in the source dashboard, you are using the token which is passed from target.

Hope this helps

[sunnyparmar]

thanks for the sharing.. I have used your first dashboard (source) like in given below format but it is giving error no result found. Could you tell me please where i am wrong

   <label>host_kpi's </label>
   <row>
     <panel>
       <table>
         <title>Perfmon:CPUTime </title>
         <search>
           <query>index=sc-perfmon|stats count by Perfmon:CPUTime </query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
         <option name="wrap">undefined</option>
         <option name="rowNumbers">undefined</option>
         <option name="drilldown">row</option>
         <drilldown>
           **<link>/app/search/target?form.sourcetype=$row.sourcetype$</link>**
         </drilldown>
       </table>
     </panel>
   </row>
 </dashboard>

[renjith_nair]

The ** around link is badly formatted bold. Please remove that and only use

          <drilldown>
            <link>/app/search/target?form.sourcetype=$row.sourcetype$</link>
          </drilldown>

[sunnyparmar]

still no result found..

[renjith_nair]

The result not found is due to lack of events. Do you have some events for below search.

index=sc-perfmon earliest=-15m|stats count by Perfmon:CPUTime

Also does it have sourcetype column in the table. By $row.sourcetype$ we are picking up the sourcetype column from the row you clicked for drilldown

[sunnyparmar]

answer for your question - does it have sourcetype column in the table. By $row.sourcetype$ we are picking up the sourcetype column from the row you clicked for drilldown

No

[renjith_nair]

To drill down from a table , the table should have the field name to pass as the token.

From your original dashboard, i took host as drilldown token since host is part of result set

Dashboard 1

      <dashboard>
       <label>Source</label>
       <row>
         <panel>
           <table>
             <title></title>
             <search>
               <query>index=sc-perfmon (collection=cputime counter="% User Time") OR (collection=Memory counter="% Committed Bytes In Use") | stats sparkline(avg(Value)) as "Load trend", latest(_time) as latest_event, latest(eval(round(Value, 2))) as "Latest value" by host,collection |eval "Seconds since latest event"=floor((now() -latest_event)) | eval "Host metric"=case(collection == "CPUTime", "CPU time user %", collection == "Memory", "Memory in use %") | table host, "Host metric", "Latest value", "Load trend", "Seconds since latest event"</query>
               <earliest>-7d@h</earliest>
               <latest>now</latest>
             </search>
             <option name="wrap">undefined</option>
             <option name="rowNumbers">undefined</option>
             <option name="drilldown">row</option>
             <drilldown>
                <link>http://10.0.xx.xx:xx/en-US/app/sc_monitoring/per_host_kpis?form.host=$row.host$</link>
             </drilldown>
           </table>
         </panel>
       </row>
     </dashboard>

Dashboard 2

I used the host which is passed from source to filter the result in search query

     <dashboard>
       <label>Target</label>
       <row>
         <panel>
           <table>
             <title></title>
             <search>
               <query>index=sc-perfmon collection=FreeDiskSpace counter="% Free Space" NOT(instance=_Total) host=$form.host$ |chart max(eval(ceiling(100-Value))) as disk_in_use over host by instance</query>
               <earliest>-7d@h</earliest>
               <latest>now</latest>
             </search>
             <option name="wrap">undefined</option>
             <option name="rowNumbers">undefined</option>
             <option name="drilldown">row</option>
           </table>
         </panel>
       </row>
     </dashboard>  

You have to now look at your data and fine tune according to your requirement.

Hope this helps!

[sunnyparmar]

ok.. thanks .. one more question that is do I need to paste whole code of dashboard 1 and dashboard 2 in one panel .. I mean is it whole 1 xml? Thanks

[renjith_nair]

The above is for two different dashboards.

[renjith_nair]

Did it help?

[renjith_nair]

For same page drill down you can use set tokens method.

Please install this https://splunkbase.splunk.com/app/1603/. This will give you an insight to token management.

Please mark as answer if you don't have further questions

[sunnyparmar]

do you mean to day that do i need to paste dashboard1 xml at the end of one dashboard xml and likewise dashboard2 xml need to be paste at the end of second dashboard xml? am I right ? sorry bothering you so much..

[sunnyparmar]

So you mean to say that do I need to add both xml codes in the different dashboards xml file like one is host kpi's dashboard and other is host overview so one xml file is for one dashboard and other is for another.. am I right? sorry i am bothering you too much..

[sunnyparmar]

no.. don't get any result for the query.. so what to do in this case? Please suggest.. thanks

[renjith_nair]

So if you don't have a result, we can not do anything unless you push some data 🙂

In between do you have some results for index=sc-perfmon earliest=-15m ? or increase the time window.

[sunnyparmar]

yes.. i am getting data for this much query (index=sc-perfmon earliest=-15m )