Splunk Search

Interactive dashboard stats count

jsalsbur
Explorer

Good afternoon
I have a stats count query leading to a single number dashboard. I was wondering if it is possible to make that dashboard interactive to click on then showing another query to show the different sites that is creating the single number ?

so I use index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor |stats count so my number would be 3
so if that number were to drop to two because a site went down could I click on that number dashboard and bring up a query to check on all three sites?

0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @jsalsbur,

It is an idea of drill down and I usually use two kinds of drill down in this case.

  • In page drilldown (My personally favorite)
  • Drill down to search

For Drill-down to search page you can do that from UI.

In-page drilldown is where the user can click on single-view and right bottom of that user can see all values. Here is how you can do it.

<search id="my_search">
  <query>index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor</query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
</search>

<row>
  <panel>
    <single>
      <search base="my_search">
        <query>stats count</query>
      </search>
    </single>
    <drilldown>
      <set token="tkn_open_sensor_values">1</set>
    </drilldown>
  </panel>
</row>
<row depends="$tkn_open_sensor_values$">
  <panel>
    <table>
      <search base="my_search">
        <query>table sensor</query>
      </search>
    </single>
  </panel>
</row>

Notice here we have two panels but second table only opens when user clicks on the single-view panel. Also to notice here that your query will run only once to show both the panels.

Hope this helps!!!

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Hello @jsalsbur,

It is an idea of drill down and I usually use two kinds of drill down in this case.

  • In page drilldown (My personally favorite)
  • Drill down to search

For Drill-down to search page you can do that from UI.

In-page drilldown is where the user can click on single-view and right bottom of that user can see all values. Here is how you can do it.

<search id="my_search">
  <query>index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor</query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
</search>

<row>
  <panel>
    <single>
      <search base="my_search">
        <query>stats count</query>
      </search>
    </single>
    <drilldown>
      <set token="tkn_open_sensor_values">1</set>
    </drilldown>
  </panel>
</row>
<row depends="$tkn_open_sensor_values$">
  <panel>
    <table>
      <search base="my_search">
        <query>table sensor</query>
      </search>
    </single>
  </panel>
</row>

Notice here we have two panels but second table only opens when user clicks on the single-view panel. Also to notice here that your query will run only once to show both the panels.

Hope this helps!!!

niketn
Legend

@jsalsbur you would need to post your query again using the code button 101010 (or shortcut Ctrl+K) so that special characters in your SPL do not escape.

Having said this, if you are using Single Value visualization or Table (Or any other Splunk's built in Visualization) to show the count you can create the Drilldown to execute another search in a different panel (and display the same) using a token. Refer to Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ContextualDrilldown

You can also get Splunk Dashboard Examples app from Splunkbase, which has several examples of creating Drilldown in Splunk.

For the community to assist you better please add more details as to what is your current visualization showing count? Which field will identify site? and How would you identify a site which is down?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jsalsbur
Explorer

Thank you this helped me accomplish it!!

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...