Dashboards & Visualizations

Drilldown to Show Source

rwardwell
Explorer

Hello All,
I have a usecase to generate a drill down from a dashboard to the "Show Source" view. I am able to open a new tab that is the show source view but it is not populated. I think I need to try and pass the sid to the show source view. I tried to do this by setting a token to equal the job.sid. However, this token has a bunch of other data such as username etc and doesn't work. Does anyone have experience linking to show source and if so how did you do it?

Thanks!

Tags (2)
0 Karma

ak9092
Path Finder

Hi @rwardwell ,

Have you had any luck in achieving this ? If yes, then can you please share your inputs as I am struggling with the same.

0 Karma

niketn
Legend

@rwardwell @ak9092 how about something like this? You have to ensure that Dashboard search for drilldown has raw events only using purely streaming command.

<dashboard>
  <label>Table with Show Source Drilldown</label>
  <search>
    <query>| makeresults
    | eval app="$env:app$"</query>
    <done>
      <set token="app">$result.app$</set>
    </done>
  </search>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <set token="sid">$job.sid$</set>
          </done>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| fields _time log_level _raw
| head 50</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">http://localhost:8000/en-US/app/$app$/show_source?sid=$sid|n$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...