how to link two dashboards in splunk 6.2

[sunnyparmar]

Hi,

I have two different dashboards one for disk space usage and other for memory and CPU utilization for two different hosts. I want to link them so that if i select one host in drill down so automatically its shows me the other KPI values also so is there any way to do this. Please give your valuable suggestions.

Thanks

[sunnyparmar]

no.. don't get any result for the query.. so what to do in this case? Please suggest.. thanks

[sunnyparmar]

I have tried this query (index=sc-perfmon earliest=-15m|stats count by Perfmon:CPUTime
) on my production server as well but there also i didn't get any data.. actually previously i was running query on Splunk test server .. but on production also it is not giving any data with this query

[fdi01]

use two pannels on a dashboard even for simply doing.
install Splunk 6.x Dashboard Examples apps it is help you very fine to do it
as several example thereof is inside, following this link https://splunkbase.splunk.com/app/1603/ to download

[sunnyparmar]

Hi,

I have made something like this within my xml code in which my first query refers to target per_host_kpi's dashboard and another query refers the target to another host overview dashboard but the issue is it is giving output for first dashboard. When I clicked on the main screen overview it takes me to the per host kpi's dashboard but when i clicked on second its not taking me to the another dashboard so any idea for this?

Dynamic Drilldown

<panel>
  <table>
    <search>
      <query>index=sc-perfmon (collection=cputime counter="% User Time") OR (collection=Memory counter="% Committed Bytes In Use") | stats sparkline(avg(Value)) as "Load trend", latest(_time) as latest_event, latest(eval(round(Value, 2))) as "Latest value" by host,collection |eval "Seconds since latest event"=floor((now() -latest_event)) | eval "Host metric"=case(collection == "CPUTime", "CPU time user %", collection == "Memory", "Memory in use %") | table host, "Host metric", "Latest value", "Load trend", "Seconds since latest event"</query>
      <earliest>-7d@h</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <link target="_blank">http://10.0.xx.xx:xx/en-US/app/sc_monitoring/per_host_kpis?form.src_type_tok=$row.sourcetype$</link>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
    <search>
      <query>index=sc-perfmon collection=FreeDiskSpace counter="% Free Space" NOT(instance=_Total) |chart max(eval(ceiling(100-Value))) as disk_in_use over host by instance</query>
      <earliest>-7d@h</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <link target="_blank">http://10.0.xx.xx:xx/en-US/app/sc_monitoring/host_overview?form.src_type_tok=$row.sourcetype$</link>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
  </table>
</panel>

thanks

[forkingforwardt]

use two pannels on a dashboard even for simply doing.
install Splunk 6.x Dashboard Examples apps it is help you very fine to do it
as several example thereof is inside, following this link https://splunkbase.splunk.com/app/1603/ to download

[sunnyparmar]

Hi,

I have made something like this within my xml code in which my first query refers to target per_host_kpi's dashboard and another query refers the target to another host overview dashboard but the issue is it is giving output for first dashboard. When I clicked on the main screen overview it takes me to the per host kpi's dashboard but when i clicked on second its not taking me to the another dashboard so any idea for this?

Dynamic Drilldown

<panel>
  <table>
    <search>
      <query>index=sc-perfmon (collection=cputime counter="% User Time") OR (collection=Memory counter="% Committed Bytes In Use") | stats sparkline(avg(Value)) as "Load trend", latest(_time) as latest_event, latest(eval(round(Value, 2))) as "Latest value" by host,collection |eval "Seconds since latest event"=floor((now() -latest_event)) | eval "Host metric"=case(collection == "CPUTime", "CPU time user %", collection == "Memory", "Memory in use %") | table host, "Host metric", "Latest value", "Load trend", "Seconds since latest event"</query>
      <earliest>-7d@h</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <link target="_blank">http://10.0.xx.xx:xx/en-US/app/sc_monitoring/per_host_kpis?form.src_type_tok=$row.sourcetype$</link>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
    <search>
      <query>index=sc-perfmon collection=FreeDiskSpace counter="% Free Space" NOT(instance=_Total) |chart max(eval(ceiling(100-Value))) as disk_in_use over host by instance</query>
      <earliest>-7d@h</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <link target="_blank">http://10.0.xx.xx:xx/en-US/app/sc_monitoring/host_overview?form.src_type_tok=$row.sourcetype$</link>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="count">10</option>
  </table>
</panel>

thanks

[renjith_nair]

Just a small suggestion : Have you tried using different panels on the same dashboard? It should give you an overall idea about all the metrics at a glance.

For two different dashboard, you can use drill down to pass the host value to the second dashboard and use it on that dashboard

For eg:

<table>
  <title>Details</title>
  <search> < search terms></search>
  <option name="wrap">true</option>
  <option name="<something"><something></option> 
  <drilldown>
    <link>/app/<appname>/<page name>?form.index=$row.index$&amp;form.host=$row.host$&amp</link>
  </drilldown>
  <option name="drilldown">row</option>
</table>