Dashboard Pivoting to Custom Search

[mjj47]

I have a visual in my splunk dashboard that I want to be able to interact with. It's a timechart showing concurrent number of users on my system. When I click on the line, it brings up bunk data from my search. Can I make it so that when I click, I link to a separate search that will be more useful?

Thanks

[Tanefo]

hi,
This should help you to solve the problem when you click on a line, the details on your selection is posted below.
run this xml and see, So you can do the same thing for your Dashboard, it will correctly be necessary to make a good query.

<form>
    <label>In-Page Drilldown with Perma-linking</label>

    <fieldset submitButton="false">
        <!--
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
         -->
        <input type="text" token="sourcetype" searchWhenChanged="true" />
    </fieldset>

    <row>
        <table id="master">
            <title>Master</title>
            <searchString>index=_internal | stats count by sourcetype</searchString>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
            <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
            <option name="drilldown">row</option>
            <drilldown>
                <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
                <set token="sourcetype">$row.sourcetype$</set>
                <!-- If we also set the form.sourcetype the input will get updated too -->
                <set token="form.sourcetype">$row.sourcetype$</set>
            </drilldown>
        </table>
    </row>

    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <chart id="detail" depends="$sourcetype$">
            <title>Detail: $sourcetype$</title>
            <searchTemplate>index=_internal sourcetype=$sourcetype$ | timechart count</searchTemplate>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
        </chart>
    </row>