Splunk Search

How to create a different search for each column in a chart?

link22
Explorer

I would like to have a chart that shows the different values (I used a unique field extraction for this) found and displays each value's count in a column.
I am trying to make each column have a unique link to dashboard I made based on the value of the column. I am fine with hard coding this in xml with the set values I have.
Any suggestions on how to go about this would be greatly appreciated. Thank you!

0 Karma
1 Solution

link22
Explorer

For others who may want to know this:
There is a special search called a conditional drilldown in which in the drilldown you have your condition tags. In the condition tags, you can have a link. I'm having a hard time making it work properly but it's a start for anyone who needs it.

View solution in original post

0 Karma

link22
Explorer

For others who may want to know this:
There is a special search called a conditional drilldown in which in the drilldown you have your condition tags. In the condition tags, you can have a link. I'm having a hard time making it work properly but it's a start for anyone who needs it.

0 Karma

link22
Explorer

Something I tried is putting this into my :

      <condition match="$click.name$==nameOfColumn">
             <set token="dashboard_tok">/app/linktodashboard</set>
      </condition>
      <condition match="$click.name$==nameOfOtherColumn">
             <set token="dashboard_tok">/app/linktodashboard</set>
      </condition>

and then in the drilldown, I replace the search string with $dashboard_tok$.

However this oddly gives my a second bar in my graph that belongs to who knows what (it is not a value being found by the field extraction and the column is completely only created by this chunk of xml).
Also what I did above just plain doesn't work... But I wanted to show some semblance of what I'm trying to do.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...