sub-linking a report

[aniketb]

Hi,

I have a weekly statistic report set up in Splunk for my executive. He sees a well plotted graph. As you know, if you click on any column, it'll show you the logs of the sourcetype that column is representing.

He asked me, if I click the column it should change the graph to that particular incident/sourcetype over the past week. Just the event counts but in a graph/report format.

Is it possible to do that? Will it be like linking a sub-report to a main report?

[Ayn · Accepted solution]

What you're talking about (as I interpret it) is called a drilldown. The UI examples app has a number of examples on different kinds of drilldowns, I highly recommend you download it and have a look if you haven't done it already. Also, these docs sections contain useful information on creating customized drilldowns.

http://docs.splunk.com/Documentation/Splunk/latest/Developer/TableChartDrilldown
http://docs.splunk.com/Documentation/Splunk/latest/User/UnderstandTableandChartDrilldownActions

[aniketb]

Exactly! Drilldown is what I was looking for!