Splunk Search

Interactive dashboard stats count

jsalsbur
Explorer

Good afternoon
I have a stats count query leading to a single number dashboard. I was wondering if it is possible to make that dashboard interactive to click on then showing another query to show the different sites that is creating the single number ?

so I use index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor |stats count so my number would be 3
so if that number were to drop to two because a site went down could I click on that number dashboard and bring up a query to check on all three sites?

0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @jsalsbur,

It is an idea of drill down and I usually use two kinds of drill down in this case.

  • In page drilldown (My personally favorite)
  • Drill down to search

For Drill-down to search page you can do that from UI.

In-page drilldown is where the user can click on single-view and right bottom of that user can see all values. Here is how you can do it.

<search id="my_search">
  <query>index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor</query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
</search>

<row>
  <panel>
    <single>
      <search base="my_search">
        <query>stats count</query>
      </search>
    </single>
    <drilldown>
      <set token="tkn_open_sensor_values">1</set>
    </drilldown>
  </panel>
</row>
<row depends="$tkn_open_sensor_values$">
  <panel>
    <table>
      <search base="my_search">
        <query>table sensor</query>
      </search>
    </single>
  </panel>
</row>

Notice here we have two panels but second table only opens when user clicks on the single-view panel. Also to notice here that your query will run only once to show both the panels.

Hope this helps!!!

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Hello @jsalsbur,

It is an idea of drill down and I usually use two kinds of drill down in this case.

  • In page drilldown (My personally favorite)
  • Drill down to search

For Drill-down to search page you can do that from UI.

In-page drilldown is where the user can click on single-view and right bottom of that user can see all values. Here is how you can do it.

<search id="my_search">
  <query>index=* sourcetype=* sensor=* OR sensor=* OR sensor=* OR |dedup sensor</query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
</search>

<row>
  <panel>
    <single>
      <search base="my_search">
        <query>stats count</query>
      </search>
    </single>
    <drilldown>
      <set token="tkn_open_sensor_values">1</set>
    </drilldown>
  </panel>
</row>
<row depends="$tkn_open_sensor_values$">
  <panel>
    <table>
      <search base="my_search">
        <query>table sensor</query>
      </search>
    </single>
  </panel>
</row>

Notice here we have two panels but second table only opens when user clicks on the single-view panel. Also to notice here that your query will run only once to show both the panels.

Hope this helps!!!

niketn
Legend

@jsalsbur you would need to post your query again using the code button 101010 (or shortcut Ctrl+K) so that special characters in your SPL do not escape.

Having said this, if you are using Single Value visualization or Table (Or any other Splunk's built in Visualization) to show the count you can create the Drilldown to execute another search in a different panel (and display the same) using a token. Refer to Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ContextualDrilldown

You can also get Splunk Dashboard Examples app from Splunkbase, which has several examples of creating Drilldown in Splunk.

For the community to assist you better please add more details as to what is your current visualization showing count? Which field will identify site? and How would you identify a site which is down?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jsalsbur
Explorer

Thank you this helped me accomplish it!!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...