Splunk Search

Automatically Viewing Visualization in Search

TylerJVitale
Explorer

I'm linking a click value token in a dashboard to a search. Is there a way to format the drilldown search string so that the visualization is shown automatically, or would I have to link to a dashboard instead of a search?

Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @TylerJVitale,

Check out this section of the documentation on tokens :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Viz/ContextualDrilldown#Show_or_hide_content

You can use rejects and depends to control when you want a panel in a dashboard to be hidden or revealed based on weather a token is set or unset. You can also apply conditions and only display panels based on those conditions. It's a good read.

Here's an example on how this is done :

<dashboard>
  <row>
    <panel>
      <table>
        <title>Event counts by sourcetype</title>
        <search>
          <query>index=_internal | stats count by sourcetype</query>
        </search>
        <drilldown>
          <set token="show_panel">true</set>
          <set token="selected_value">$click.value$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$show_panel$">
      <event>
        <title>Recent events for $selected_value$</title>
        <search>
          <query>index=_internal sourcetype=$selected_value$ </query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="count">5</option>
      </event>
    </panel>
  </row>
</dashboard>

Let me know if this helps you.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @TylerJVitale,

Check out this section of the documentation on tokens :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Viz/ContextualDrilldown#Show_or_hide_content

You can use rejects and depends to control when you want a panel in a dashboard to be hidden or revealed based on weather a token is set or unset. You can also apply conditions and only display panels based on those conditions. It's a good read.

Here's an example on how this is done :

<dashboard>
  <row>
    <panel>
      <table>
        <title>Event counts by sourcetype</title>
        <search>
          <query>index=_internal | stats count by sourcetype</query>
        </search>
        <drilldown>
          <set token="show_panel">true</set>
          <set token="selected_value">$click.value$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$show_panel$">
      <event>
        <title>Recent events for $selected_value$</title>
        <search>
          <query>index=_internal sourcetype=$selected_value$ </query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="count">5</option>
      </event>
    </panel>
  </row>
</dashboard>

Let me know if this helps you.

Cheers,
David

0 Karma

Vijeta
Influencer

@TylerJVitale you can link to a panel, when the token is set on clicking the panel with visualization will show up. the panel should be dependent on your token, <panel depends="$tokenname$">

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...