Splunk Enterprise

help on panel depends

jip31
Motivator

Hello

I need to open another panel from my main panel when I click on the field "web_url"

So I need to display the events related to the field "web_url" in my second dashboard

Here is what Iam doing but it opens all the events and not only the events related to "web_url"...

What is wrong please?

 <panel>
      <title>URL Web</title>
      <table>
        <search>
          <query>index=mes sourcetype=web  
| stats sum(web_error_count) as "Total erreurs Http" by web_url 
| rename web_url as web_url
| sort - "Total erreurs Http"</query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <refresh>30s</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <format type="number" field="Parameters"></format>
        <format type="number" field="ResponseTime">
          <option name="precision">1</option>
          <option name="unit">ms</option>
          <option name="useThousandSeparators">false</option>
        </format>
        <format type="color" field="Web Error Count">
          <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Total erreurs Http">
          <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <drilldown>
          <set token="web_url">$click.value$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$web_url$">
      <table>
        <title>Response= $web_url$</title>
        <search>
          <query>index=mes sourcetype=web  
| table "ID" "Nom"  site type"</query>

 

Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

$web_url$ doesn't (currently) appear in the query for your second panel which is why it isn't being filtered by $web_url$

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

$web_url$ doesn't (currently) appear in the query for your second panel which is why it isn't being filtered by $web_url$

0 Karma

jip31
Motivator

oh of course....... 

thanks

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...