Splunk Search

How to swap out the underlying search in a dashboard for a table drilldown using Simple XML?

lassel
Communicator

Hi,

I want to do this, but I'd prefer to do it in Simple XML. Is it possible?
http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/TableChartDrilldown#Swap_out_the_under...

I have a table in a dashboard, that shows available log files to the users.

When I drill down, I want to use the values from the row that was clicked, but I don't want the search from the table to go into the drilldown search. That would make the user search in the summary index - and that doesn't make sense, since the index is part of the row clicked!

<dashboard>
  <label>View all logs</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">100</option>
        <option name="table.sortColumn">index</option>
      </table>
    </panel>
  </row>
</dashboard>

Once I get it right, I'll change the dashboard to be powered by a summary index. That just makes it even more important that the drilldown search does not contain the table search.

0 Karma
1 Solution

lassel
Communicator

Here's a complete working dashboard, with drilldown.

 <dashboard>
   <label>View all logs</label>
   <row>
     <panel>
       <table>
         <search>
           <query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
         <option name="wrap">true</option>
         <option name="rowNumbers">true</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">row</option>
         <option name="count">100</option>
         <option name="table.sortColumn">index</option>
         <drilldown>
           <link>/app/search/search?q=index=$row.index$ sourcetype=$row.sourcetype$</link>
         </drilldown>
       </table>
     </panel>
   </row>
 </dashboard>

Drilldown only uses index and source for drilldown.
It is easy to add sourcetype too, but if it contains a windows path, it will require some work, escaping backslashes. So I left it out for clarity.

View solution in original post

0 Karma

lassel
Communicator

Here's a complete working dashboard, with drilldown.

 <dashboard>
   <label>View all logs</label>
   <row>
     <panel>
       <table>
         <search>
           <query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
         <option name="wrap">true</option>
         <option name="rowNumbers">true</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">row</option>
         <option name="count">100</option>
         <option name="table.sortColumn">index</option>
         <drilldown>
           <link>/app/search/search?q=index=$row.index$ sourcetype=$row.sourcetype$</link>
         </drilldown>
       </table>
     </panel>
   </row>
 </dashboard>

Drilldown only uses index and source for drilldown.
It is easy to add sourcetype too, but if it contains a windows path, it will require some work, escaping backslashes. So I left it out for clarity.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Are you looking to define a custom search on drilldown? You can simply link to that search then. Run the search you want to run when drilling down and copy the link from the browser address bar. Paste it between the link tags:

<table>
  <search>
    <query>...</query>
    <earliest>...</earliest>
    <latest>...</latest>
  </search>
  ...
  <option name="count">10</option>
  <drilldown>
    <link> paste link here </link>
  </drilldown>
</table>

That should take you to the search right away.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...