Splunk Enterprise

help on panel depends

jip31
Motivator

Hello

I need to open another panel from my main panel when I click on the field "web_url"

So I need to display the events related to the field "web_url" in my second dashboard

Here is what Iam doing but it opens all the events and not only the events related to "web_url"...

What is wrong please?

 <panel>
      <title>URL Web</title>
      <table>
        <search>
          <query>index=mes sourcetype=web  
| stats sum(web_error_count) as "Total erreurs Http" by web_url 
| rename web_url as web_url
| sort - "Total erreurs Http"</query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <refresh>30s</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <format type="number" field="Parameters"></format>
        <format type="number" field="ResponseTime">
          <option name="precision">1</option>
          <option name="unit">ms</option>
          <option name="useThousandSeparators">false</option>
        </format>
        <format type="color" field="Web Error Count">
          <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Total erreurs Http">
          <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <drilldown>
          <set token="web_url">$click.value$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$web_url$">
      <table>
        <title>Response= $web_url$</title>
        <search>
          <query>index=mes sourcetype=web  
| table "ID" "Nom"  site type"</query>

 

Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

$web_url$ doesn't (currently) appear in the query for your second panel which is why it isn't being filtered by $web_url$

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

$web_url$ doesn't (currently) appear in the query for your second panel which is why it isn't being filtered by $web_url$

0 Karma

jip31
Motivator

oh of course....... 

thanks

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...