Dashboards & Visualizations

How do I set drilldown if I want to set several pages to go?

appleman
Contributor

Hello there,

I want to set drilldown on the dashboard attached below, but how can I set if I want to set several token?
Here is what I want to do;
If you click the column "InstallProfile" under command, it goes to the page which its search is "source=xxx".
Or if you click the column "EnrollDevice", it goes to another page which its search is "source=yyy".

Please give me some advice.

Thank you.


添付のテーブル上で、"InstallProfile"をクリックすると、"source=xxx"が設定されているページに遷移し、他のコマンド、(例:"EnrollDevice")をクリックすると、今度は"source=yyy"というページに遷移するようにドリルダウンを設定したい場合、どのように設定したらよいのでしょうか。

alt text

0 Karma
1 Solution

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

View solution in original post

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

appleman
Contributor

Thank you! Your query helped me a lot!

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...