Dashboards & Visualizations
Highlighted

sub-linking a report

Path Finder

Hi,

I have a weekly statistic report set up in Splunk for my executive. He sees a well plotted graph. As you know, if you click on any column, it'll show you the logs of the sourcetype that column is representing.

He asked me, if I click the column it should change the graph to that particular incident/sourcetype over the past week. Just the event counts but in a graph/report format.

Is it possible to do that? Will it be like linking a sub-report to a main report?

0 Karma
Highlighted

Re: sub-linking a report

Legend

What you're talking about (as I interpret it) is called a drilldown. The UI examples app has a number of examples on different kinds of drilldowns, I highly recommend you download it and have a look if you haven't done it already. Also, these docs sections contain useful information on creating customized drilldowns.

http://docs.splunk.com/Documentation/Splunk/latest/Developer/TableChartDrilldown
http://docs.splunk.com/Documentation/Splunk/latest/User/UnderstandTableandChartDrilldownActions

View solution in original post

Highlighted

Re: sub-linking a report

Path Finder

Exactly! Drilldown is what I was looking for!

0 Karma