Splunk Search

How to display an event with it's corresponding parameters in a different page, in a tabular format?

New Member

I have multiple events getting indexed in Splunk. Now, on clicking a particular event I want it along with it's corresponding parameters(like time, threadname, host, event details->linked to that event only)to come in an entirely different page in a table format.

Hope my question is clear, please guide me.

Tags (2)
0 Karma

Legend

To do this you'd need to setup two things:
a) a drilldown from the original view, and
b) a view that presents the results in the way you want.

Both these can be definitely be done. You'll want to have a look at the Dashboard Examples app which shows you with examples how to do all kinds of things with Splunk views.

New Member

How about a pop up or rather say a new dashboard with the details of the only row corresponding to the clicked event? All the fetched details are expected to come in a table in the new pop up/dashboard.

0 Karma

Legend

With you right up until the different page part. Do you want to have a separate browser window B with another page that somehow listens for search results from window A? If so that could prove difficult.

0 Karma