Is it possible to create this Clickable Dashboard?

[Kk]

Hey all, I'm trying to build a clickable dashboard. For that, I had choosen line chart visualization. So in the below pic you can see the line chart resulting count of events with respective some random id. So my idea is to make that id or count clickable so that we redirect to see the original events i.e for below shown id we should able to see all 6,630 event logs in new tab.. Is that possible by any chance?

Thanks in advance

@ITWhisperer 

[richgalloway]

That would be a drilldown.  Edit the dashboard panel, click on the triple dots, then select "Edit Drilldown".

Change the "On Click" setting to "Link to search", click Custom, then enter the SPL you want to run when a user clicks on the dashboard.

[ITWhisperer · Accepted solution]

Short answer: yes, it is possible

Longer answer: In your drilldown for the chart, you can use $click.name2$ as the name of the series, which you can add to an encoded search url to open the search in another tab.

[Kk]

Ok thanks. Can you provide the Xml for linking the search string when we click on result?

[gcusello]

Hi @Kk,

as I said, see in the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603/)

You'll find many samples of XML you need to adapt to many Use Cases..

Ciao.

Giuseppe

[gcusello]

Hi @Kk,

the result you like is possible and you can find how to do this searching for "Drilldown" ,

these are some useful links

https://www.youtube.com/watch?v=iNXj1uWTQes

https://docs.splunk.com/Documentation/Splunk/8.2.6/Viz/DrilldownIntro

My hint is to install on your Splunk the splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603/) wher you can find many example about how to implement drilldown.

Ciao.

Giuseppe