Interactive dashboard stats count

[jsalsbur]

Good afternoon
I have a stats count query leading to a single number dashboard. I was wondering if it is possible to make that dashboard interactive to click on then showing another query to show the different sites that is creating the single number ?

so I use index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor |stats count so my number would be 3
so if that number were to drop to two because a site went down could I click on that number dashboard and bring up a query to check on all three sites?

[VatsalJagani · Accepted solution]

Hello @jsalsbur,

It is an idea of drill down and I usually use two kinds of drill down in this case.

• In page drilldown (My personally favorite)
• Drill down to search

For Drill-down to search page you can do that from UI.

In-page drilldown is where the user can click on single-view and right bottom of that user can see all values. Here is how you can do it.

<search id="my_search">
  <query>index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor</query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
</search>

<row>
  <panel>
    <single>
      <search base="my_search">
        <query>stats count</query>
      </search>
    </single>
    <drilldown>
      <set token="tkn_open_sensor_values">1</set>
    </drilldown>
  </panel>
</row>
<row depends="$tkn_open_sensor_values$">
  <panel>
    <table>
      <search base="my_search">
        <query>table sensor</query>
      </search>
    </single>
  </panel>
</row>

Notice here we have two panels but second table only opens when user clicks on the single-view panel. Also to notice here that your query will run only once to show both the panels.

Hope this helps!!!

[niketn]

@jsalsbur you would need to post your query again using the code button 101010 (or shortcut Ctrl+K) so that special characters in your SPL do not escape.

Having said this, if you are using Single Value visualization or Table (Or any other Splunk's built in Visualization) to show the count you can create the Drilldown to execute another search in a different panel (and display the same) using a token. Refer to Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ContextualDrilldown

You can also get Splunk Dashboard Examples app from Splunkbase, which has several examples of creating Drilldown in Splunk.

For the community to assist you better please add more details as to what is your current visualization showing count? Which field will identify site? and How would you identify a site which is down?

[jsalsbur]

Thank you this helped me accomplish it!!