Hi there,
I need to create a table with static headings as well as static body entries, however these body entries when clicked on will drilldown to events that are categorized under them.
IE-
Protect | Detect | Respond
Asset management | access control | Planning
Business environment | Security | Analysis
So all of that would be static information. When a user clicks on "asset management" or any of the other rows under a heading it will drilldown to display events that have been categorized to it.
Any thoughts on how to go about doing this(especially adding many unique values under the headings - i am using the eval command so far)?
Thanks!
I would create a static lookup table (csv) to store your static table values and use inputlookup command to populate the same.
I would create a static lookup table (csv) to store your static table values and use inputlookup command to populate the same.
Thanks for the reply..
Would I then be able to create drilldowns in my dashboard and relate search values to the static inpullookup?
Yes, after you show the static table from the lookup, you'll be able to setup drilldown (see below link) to another visualization/dashboard to show actual events corresponding to clicked values (see 2nd URL for different tokens available for drilldown)
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...
Also, install Splunk .x dashboard example app and you can find working examples of drilldowns that you can refer.
https://splunkbase.splunk.com/app/1603/
Awesome, thats exactly what I needed.. Thanks for the help!