Dashboards & Visualizations

Drill down into new visualization

bcusick
Communicator

Hi,

I have multiple timecharts on a dashboard. When I drill down on a certain result, the raw log shows up (normal). What I would like to do is have a table show up instead. I know I can use the "selected fields" option, but I would rather a table come up due to different fields for different searches. The goal is all about "user experience". Is this possible?

0 Karma
1 Solution

lguinn2
Legend

Yes! You can set up drill-down on a dashboard - in several ways. While another answer talks about customizing the flashtimeline view, there are much easier ways to customize your dashboard.

First, you can edit the visualization on the dashboard to control basic drilldown,but I think you have already done that.

Second, you can edit the simple XML underlying your dashboard and link the drilldown to a custom form or URL. Here is the section on drilldown in the documentation. I believe that this will do what you want, and it has a lot of flexibility.

A third option is to take even more control of the dashboard by converting it to advanced XML and then adding the drilldown as described here. I don't think this will be necessary to get what you want, though.

View solution in original post

lguinn2
Legend

Yes! You can set up drill-down on a dashboard - in several ways. While another answer talks about customizing the flashtimeline view, there are much easier ways to customize your dashboard.

First, you can edit the visualization on the dashboard to control basic drilldown,but I think you have already done that.

Second, you can edit the simple XML underlying your dashboard and link the drilldown to a custom form or URL. Here is the section on drilldown in the documentation. I believe that this will do what you want, and it has a lot of flexibility.

A third option is to take even more control of the dashboard by converting it to advanced XML and then adding the drilldown as described here. I don't think this will be necessary to get what you want, though.

somesoni2
SplunkTrust
SplunkTrust

Before I answer this,
question1 = are your drilldown open flashtimeline (search app) view?
question2= if yes, the if its Ok for you to modify it or you're Ok to create a similar flashtimeline_custom view?

If both the answers are yes, You can change the default behaviour of flashtimeline (or flashtimeline_custom) by doing this.

Optional Step 1: clone flashtimeline into a new view flashtimeline_custom (if you want to keep it separate)
Step 2. Open the xml for flashtimeline (or urs new flashtimeline) and search for following entry

              <module name="ButtonSwitcher" layoutPanel="pageControls">
                <param name="mode">independent</param>
                <param name="hideChildrenOnLoad">True</param>
                <param name="selected">splIcon-events-list</param>

Step 3. On the last entry (param name=selected), change the value from splIcon-events-list to splIcon-results-table. and you are all set. You flashtimeline will now show results in table view by default.

Options Step 3: If you have created a flashtimeline_custom, change the drilldown Redirector module to point to flashtimeline_custom.
Change

  <module name="Redirector">
    <param name="url">flashtimeline</param>

To

<module name="Redirector">
<param name="url">flashtimeline_custom</param>
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...