Splunk Search

How to swap out the underlying search in a dashboard for a table drilldown using Simple XML?

lassel
Communicator

Hi,

I want to do this, but I'd prefer to do it in Simple XML. Is it possible?
http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/TableChartDrilldown#Swap_out_the_under...

I have a table in a dashboard, that shows available log files to the users.

When I drill down, I want to use the values from the row that was clicked, but I don't want the search from the table to go into the drilldown search. That would make the user search in the summary index - and that doesn't make sense, since the index is part of the row clicked!

<dashboard>
  <label>View all logs</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">100</option>
        <option name="table.sortColumn">index</option>
      </table>
    </panel>
  </row>
</dashboard>

Once I get it right, I'll change the dashboard to be powered by a summary index. That just makes it even more important that the drilldown search does not contain the table search.

0 Karma
1 Solution

lassel
Communicator

Here's a complete working dashboard, with drilldown.

 <dashboard>
   <label>View all logs</label>
   <row>
     <panel>
       <table>
         <search>
           <query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
         <option name="wrap">true</option>
         <option name="rowNumbers">true</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">row</option>
         <option name="count">100</option>
         <option name="table.sortColumn">index</option>
         <drilldown>
           <link>/app/search/search?q=index=$row.index$ sourcetype=$row.sourcetype$</link>
         </drilldown>
       </table>
     </panel>
   </row>
 </dashboard>

Drilldown only uses index and source for drilldown.
It is easy to add sourcetype too, but if it contains a windows path, it will require some work, escaping backslashes. So I left it out for clarity.

View solution in original post

0 Karma

lassel
Communicator

Here's a complete working dashboard, with drilldown.

 <dashboard>
   <label>View all logs</label>
   <row>
     <panel>
       <table>
         <search>
           <query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
         <option name="wrap">true</option>
         <option name="rowNumbers">true</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">row</option>
         <option name="count">100</option>
         <option name="table.sortColumn">index</option>
         <drilldown>
           <link>/app/search/search?q=index=$row.index$ sourcetype=$row.sourcetype$</link>
         </drilldown>
       </table>
     </panel>
   </row>
 </dashboard>

Drilldown only uses index and source for drilldown.
It is easy to add sourcetype too, but if it contains a windows path, it will require some work, escaping backslashes. So I left it out for clarity.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Are you looking to define a custom search on drilldown? You can simply link to that search then. Run the search you want to run when drilling down and copy the link from the browser address bar. Paste it between the link tags:

<table>
  <search>
    <query>...</query>
    <earliest>...</earliest>
    <latest>...</latest>
  </search>
  ...
  <option name="count">10</option>
  <drilldown>
    <link> paste link here </link>
  </drilldown>
</table>

That should take you to the search right away.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...