Splunk Search

How to display an event with it's corresponding parameters in a different page, in a tabular format?

Shoumo
New Member

I have multiple events getting indexed in Splunk. Now, on clicking a particular event I want it along with it's corresponding parameters(like time, threadname, host, event details->linked to that event only)to come in an entirely different page in a table format.

Hope my question is clear, please guide me.

Tags (2)
0 Karma

Ayn
Legend

To do this you'd need to setup two things:
a) a drilldown from the original view, and
b) a view that presents the results in the way you want.

Both these can be definitely be done. You'll want to have a look at the Dashboard Examples app which shows you with examples how to do all kinds of things with Splunk views.

Shoumo
New Member

How about a pop up or rather say a new dashboard with the details of the only row corresponding to the clicked event? All the fetched details are expected to come in a table in the new pop up/dashboard.

0 Karma

Ayn
Legend

With you right up until the different page part. Do you want to have a separate browser window B with another page that somehow listens for search results from window A? If so that could prove difficult.

0 Karma
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...