Dashboards & Visualizations

How to pass multiple values from a drilldown in a table to a separate dashboard?

Wiggy
Splunk Employee
Splunk Employee

Say I have a dashboard with a panel that generates a table of values and I want to be able to drill down on several values of the row when I click on one of the values within that row. How do you go about this using simple xml, and could I get an example?

1 Solution

Wiggy
Splunk Employee
Splunk Employee

You have to use the drilldown element as linked here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...

With the link value, you specify the separate view that you want the drilldown values to get passed to and then list out the values separated by "&".

The following two xml examples show how to set up drilldown options in one view, and how to accept them in the second view. This first view (we will call the dashboard "test1" will generate a table of values sourcetype, component, name and count. When you click on a value in the table, the sourcetype, component and name of that row will be sent to the second dashboard (we will call test2).

Dashboard xml for "test1" which has the drilldown table:

<dashboard>
  <label>test1</label>
  <description/>
  <row>
    <panel>
      <table>
        <title>Test for drilldown case</title>
        <searchString>index=_internal | stats count by sourcetype, component, name</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <drilldown>
          <link>
            <![CDATA[
              /app/search/test2?form.sourcetype=$row.sourcetype$&form.component=$row.component$&form.name=$row.name$
            ]]>
          </link>
        </drilldown>  
      </table>
    </panel>
  </row>
</dashboard>

Dashboard xml for "test2" which accepts the drilldown values passed from "test1" dashboard:

<dashboard>
  <label>test2</label>
  <description/>
  <row>
    <panel>
      <event>
        <title>drill down panel</title>
        <searchString>index=_internal sourcetype=$form.sourcetype$ component=$form.component$ name=$form.name$</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">0</option>
        <option name="dataOverlayMode">none</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</dashboard>

You will notice that the values get passed via the url and the search in the "test2" dashboard panel is populated with the values passed from the row clicked on in "test1".

View solution in original post

algalvan
Explorer

Is there a way to pass multiple values on the same dashboard?

sumeetsirohi1
New Member

@algalvan Did you find a way to do this on the same dashboard?

0 Karma

Wiggy
Splunk Employee
Splunk Employee

You have to use the drilldown element as linked here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...

With the link value, you specify the separate view that you want the drilldown values to get passed to and then list out the values separated by "&".

The following two xml examples show how to set up drilldown options in one view, and how to accept them in the second view. This first view (we will call the dashboard "test1" will generate a table of values sourcetype, component, name and count. When you click on a value in the table, the sourcetype, component and name of that row will be sent to the second dashboard (we will call test2).

Dashboard xml for "test1" which has the drilldown table:

<dashboard>
  <label>test1</label>
  <description/>
  <row>
    <panel>
      <table>
        <title>Test for drilldown case</title>
        <searchString>index=_internal | stats count by sourcetype, component, name</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <drilldown>
          <link>
            <![CDATA[
              /app/search/test2?form.sourcetype=$row.sourcetype$&form.component=$row.component$&form.name=$row.name$
            ]]>
          </link>
        </drilldown>  
      </table>
    </panel>
  </row>
</dashboard>

Dashboard xml for "test2" which accepts the drilldown values passed from "test1" dashboard:

<dashboard>
  <label>test2</label>
  <description/>
  <row>
    <panel>
      <event>
        <title>drill down panel</title>
        <searchString>index=_internal sourcetype=$form.sourcetype$ component=$form.component$ name=$form.name$</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">0</option>
        <option name="dataOverlayMode">none</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</dashboard>

You will notice that the values get passed via the url and the search in the "test2" dashboard panel is populated with the values passed from the row clicked on in "test1".

anwarmian
Communicator

Wiggy, very nice example!!!!!!! I would have given you extra points but we are not allowed to.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...