Dashboards & Visualizations

How do I set drilldown if I want to set several pages to go?

appleman
Contributor

Hello there,

I want to set drilldown on the dashboard attached below, but how can I set if I want to set several token?
Here is what I want to do;
If you click the column "InstallProfile" under command, it goes to the page which its search is "source=xxx".
Or if you click the column "EnrollDevice", it goes to another page which its search is "source=yyy".

Please give me some advice.

Thank you.


添付のテーブル上で、"InstallProfile"をクリックすると、"source=xxx"が設定されているページに遷移し、他のコマンド、(例:"EnrollDevice")をクリックすると、今度は"source=yyy"というページに遷移するようにドリルダウンを設定したい場合、どのように設定したらよいのでしょうか。

alt text

0 Karma
1 Solution

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

View solution in original post

gauldridge
Path Finder

One way I have solved a similar problem in the past is to have a generic form search view that is the target of a drilldown. For example, the Simple XML for the dashboard panel you showed could include the following:

<drilldown target="_blank">
  <link>
    /app/{appname_here}/generic_landing_view?form.incomingToken=$row.command$
  </link>
</drilldown>

In the <fieldset> section of the target page, make sure to include:

<input type="text" token="incomingToken" />

Then your search string would be:

source=[| gentimes start=-1 | eval value="$incomingToken$" | eval value=case(value=="InstallProfile","xxx",value=="EnrollDevice","yyy") | fields value | rename value AS search]

You can make the case statement as large and complicated as need be to take all your possible values into account.

appleman
Contributor

Thank you! Your query helped me a lot!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...