Splunk Search

Static and Dynamic Table with drilldowns

mansel_scheffel
Explorer

Hi there,

I need to create a table with static headings as well as static body entries, however these body entries when clicked on will drilldown to events that are categorized under them.

IE-

Protect | Detect | Respond
Asset management | access control | Planning
Business environment | Security | Analysis

So all of that would be static information. When a user clicks on "asset management" or any of the other rows under a heading it will drilldown to display events that have been categorized to it.

Any thoughts on how to go about doing this(especially adding many unique values under the headings - i am using the eval command so far)?

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

I would create a static lookup table (csv) to store your static table values and use inputlookup command to populate the same.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I would create a static lookup table (csv) to store your static table values and use inputlookup command to populate the same.

0 Karma

mansel_scheffel
Explorer

Thanks for the reply..

Would I then be able to create drilldowns in my dashboard and relate search values to the static inpullookup?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Yes, after you show the static table from the lookup, you'll be able to setup drilldown (see below link) to another visualization/dashboard to show actual events corresponding to clicked values (see 2nd URL for different tokens available for drilldown)

http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...

Also, install Splunk .x dashboard example app and you can find working examples of drilldowns that you can refer.
https://splunkbase.splunk.com/app/1603/

0 Karma

mansel_scheffel
Explorer

Awesome, thats exactly what I needed.. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...