Dashboards & Visualizations

Drilldown link in dashboard

Branden
Builder

I have a dashboard displaying various results (charts, single values, some raw output). The dashboard uses HiddenSavedSearches to get the results.

My understanding is that there is no way to drilldown from a SingleValue field. So I'd like to create a hyperlink near the SingleValue field that will link the user to the results of the search.

For example, here is part of the dashboard:

<module name="HiddenSavedSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
      <param name="savedSearch">Check XYZ</param>
      <param name="useHistory">Auto</param>
      <module name="HiddenPostProcess">
         <param name="search">search host="abc" | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                   <param name="field">yesno</param>
                   <param name="classField">range</param>
                   <param name="beforeLabel">XYZ:</param>
                </module>
           </module>
       </module>

I'd like the user to be able to either 1) click the SingleValue rectangle and view the search results or, if that is not possible, 2) click a nearby link to produce the detailed results. 

Ideally, clicking the link would not kick off a new search, but would simply use the results of the last HiddenSavedSearch.

Is this possible?

Thanks!

Tags (2)
0 Karma
1 Solution

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

View solution in original post

chris
Motivator

Hi Branden

This is kind of possible.

You have to choose between making the text in the single value to a link and triggering a new search and having a link below the single value without triggering a new search.

<view template="dashboard.html">
    <label>Test</label>   
    <module name="AccountBar" layoutPanel="appHeader"/>   
    <module name="AppBar" layoutPanel="navigationHeader"/>   
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>

    <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True">
        <param name="search">index=*</param>
        <param name="useHistory">Auto</param>
        <module name="HiddenPostProcess">
            <param name="search">search  | stats count | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low </param>
            <module name="SingleValue">
                <param name="field">yesno</param>
                <param name="classField">range</param>
                <param name="beforeLabel">XYZ:</param>
                <param name="linkFields">result,beforeLabel,afterLabel</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">search what you want</param>      
            </module>
            <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
                <param name="label">View results</param>
            </module>
        </module>
    </module>
</view>

Branden
Builder

I ended up using the latter (link below without triggering a new search). Works like a charm, thanks so much!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...