Static and Dynamic Table with drilldowns

[mansel_scheffel]

Hi there,

I need to create a table with static headings as well as static body entries, however these body entries when clicked on will drilldown to events that are categorized under them.

IE-

Protect | Detect | Respond
Asset management | access control | Planning
Business environment | Security | Analysis

So all of that would be static information. When a user clicks on "asset management" or any of the other rows under a heading it will drilldown to display events that have been categorized to it.

Any thoughts on how to go about doing this(especially adding many unique values under the headings - i am using the eval command so far)?

Thanks!

[somesoni2 · Accepted solution]

I would create a static lookup table (csv) to store your static table values and use inputlookup command to populate the same.

[mansel_scheffel]

Thanks for the reply..

Would I then be able to create drilldowns in my dashboard and relate search values to the static inpullookup?

[somesoni2]

Yes, after you show the static table from the lookup, you'll be able to setup drilldown (see below link) to another visualization/dashboard to show actual events corresponding to clicked values (see 2nd URL for different tokens available for drilldown)

http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...

Also, install Splunk .x dashboard example app and you can find working examples of drilldowns that you can refer.
https://splunkbase.splunk.com/app/1603/

[mansel_scheffel]

Awesome, thats exactly what I needed.. Thanks for the help!