I have a single value panel which is generated from the spl below:
| inputlookup AD_User_LDAP_list where OU=Staff isDeleted=FALSE |stats count
I would like to drill down when clicked and display a list of users in another panel (the results of the spl below):
| inputlookup AD_User_LDAP_list where OU=Staff isDeleted=FALSE |table sAMAccountName
Can someone kindly explain how to do this
TIA
Use below-
<drilldown target="_blank">
<link>
/app/dashboard_examples/form_table2?form.sourcetype=$row.sourcetype$
</link>
</drilldown>
Here target=_blank helps to move to another dashboard and dashboard link needs to be provied in link tag and add token of your sAMAccountName in the link itself.
Remember you have to display sAMAccountName in first dashboard table. because stats count will only show count. and sAMAccountName will be used as token for next dashboard.
You can install Splunk Dashboard Examples app from splunk base which has multiple useful example on drilldown. https://splunkbase.splunk.com/app/1603/