Splunk Search

Interactive dashboard stats count

jsalsbur
Explorer

Good afternoon
I have a stats count query leading to a single number dashboard. I was wondering if it is possible to make that dashboard interactive to click on then showing another query to show the different sites that is creating the single number ?

so I use index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor |stats count so my number would be 3
so if that number were to drop to two because a site went down could I click on that number dashboard and bring up a query to check on all three sites?

0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @jsalsbur,

It is an idea of drill down and I usually use two kinds of drill down in this case.

  • In page drilldown (My personally favorite)
  • Drill down to search

For Drill-down to search page you can do that from UI.

In-page drilldown is where the user can click on single-view and right bottom of that user can see all values. Here is how you can do it.

<search id="my_search">
  <query>index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor</query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
</search>

<row>
  <panel>
    <single>
      <search base="my_search">
        <query>stats count</query>
      </search>
    </single>
    <drilldown>
      <set token="tkn_open_sensor_values">1</set>
    </drilldown>
  </panel>
</row>
<row depends="$tkn_open_sensor_values$">
  <panel>
    <table>
      <search base="my_search">
        <query>table sensor</query>
      </search>
    </single>
  </panel>
</row>

Notice here we have two panels but second table only opens when user clicks on the single-view panel. Also to notice here that your query will run only once to show both the panels.

Hope this helps!!!

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Hello @jsalsbur,

It is an idea of drill down and I usually use two kinds of drill down in this case.

  • In page drilldown (My personally favorite)
  • Drill down to search

For Drill-down to search page you can do that from UI.

In-page drilldown is where the user can click on single-view and right bottom of that user can see all values. Here is how you can do it.

<search id="my_search">
  <query>index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor</query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
</search>

<row>
  <panel>
    <single>
      <search base="my_search">
        <query>stats count</query>
      </search>
    </single>
    <drilldown>
      <set token="tkn_open_sensor_values">1</set>
    </drilldown>
  </panel>
</row>
<row depends="$tkn_open_sensor_values$">
  <panel>
    <table>
      <search base="my_search">
        <query>table sensor</query>
      </search>
    </single>
  </panel>
</row>

Notice here we have two panels but second table only opens when user clicks on the single-view panel. Also to notice here that your query will run only once to show both the panels.

Hope this helps!!!

niketn
Legend

@jsalsbur you would need to post your query again using the code button 101010 (or shortcut Ctrl+K) so that special characters in your SPL do not escape.

Having said this, if you are using Single Value visualization or Table (Or any other Splunk's built in Visualization) to show the count you can create the Drilldown to execute another search in a different panel (and display the same) using a token. Refer to Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ContextualDrilldown

You can also get Splunk Dashboard Examples app from Splunkbase, which has several examples of creating Drilldown in Splunk.

For the community to assist you better please add more details as to what is your current visualization showing count? Which field will identify site? and How would you identify a site which is down?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jsalsbur
Explorer

Thank you this helped me accomplish it!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...