Dashboards & Visualizations

Dashboard of Jobs

raziasaduddin
Path Finder

I want to create a dashboard that shows the completed runs of all scheduled searches and allows someone to click on them to view the results akin to what the jobs screen does.

Here is the query I have to display that:

| rest /services/search/jobs | search dispatchState="DONE" delegate="scheduler" | eval url="https://splunkserver:port/en-US/app/search/flashtimeline?sid="+sid

I want people to be able to click on the url field and get taken to that url.

Tags (4)
0 Karma
1 Solution

LukeMurphey
Champion

You should be able to do this in simple XML using the drilldown attribute with a link of /en-US/app/search/flashtimeline?sid=$row.sid$:

<table>
<title>Dashboard of Jobs </title>
    <searchString>| rest /services/search/jobs | search dispatchState="DONE" delegate="scheduler" | fields label sid </searchString>
<drilldown>
     <link>/en-US/app/search/flashtimeline?sid=$row.sid$ </link>
</drilldown>
 </table>

Please ignore that extra space on each of the tags. For the life of me, I cannot get Splunk-Base to list list the literal XML. See http://pastebin.com/Jf8eNqMF for a better version.

View solution in original post

LukeMurphey
Champion

You should be able to do this in simple XML using the drilldown attribute with a link of /en-US/app/search/flashtimeline?sid=$row.sid$:

<table>
<title>Dashboard of Jobs </title>
    <searchString>| rest /services/search/jobs | search dispatchState="DONE" delegate="scheduler" | fields label sid </searchString>
<drilldown>
     <link>/en-US/app/search/flashtimeline?sid=$row.sid$ </link>
</drilldown>
 </table>

Please ignore that extra space on each of the tags. For the life of me, I cannot get Splunk-Base to list list the literal XML. See http://pastebin.com/Jf8eNqMF for a better version.

LukeMurphey
Champion

@Ayn: Thanks, that looks much better. It hadn't occurred to me that just the preview was broken.

0 Karma

Ayn
Legend

I fixed the formatting for you, hope that's OK. Unfortunately it seems the post preview removes tags even though it works just fine once you've submitted your post.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...