Dashboards & Visualizations

Drilldown link in dashboard

Branden
Builder

I have a dashboard displaying various results (charts, single values, some raw output). The dashboard uses HiddenSavedSearches to get the results.

My understanding is that there is no way to drilldown from a SingleValue field. So I'd like to create a hyperlink near the SingleValue field that will link the user to the results of the search.

For example, here is part of the dashboard:

<module name="HiddenSavedSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
      <param name="savedSearch">Check XYZ</param>
      <param name="useHistory">Auto</param>
      <module name="HiddenPostProcess">
         <param name="search">search host="abc" | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                   <param name="field">yesno</param>
                   <param name="classField">range</param>
                   <param name="beforeLabel">XYZ:</param>
                </module>
           </module>
       </module>

I'd like the user to be able to either 1) click the SingleValue rectangle and view the search results or, if that is not possible, 2) click a nearby link to produce the detailed results. 

Ideally, clicking the link would not kick off a new search, but would simply use the results of the last HiddenSavedSearch.

Is this possible?

Thanks!

Tags (2)
0 Karma
1 Solution

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

View solution in original post

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

Branden
Builder

I ended up using the latter (link below without triggering a new search). Works like a charm, thanks so much!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...