How to create a drilldown from a chart in one dashboard to another dashboard in Splunk 6.x.x?

[Kumar1980]

HI,

I am very new to Splunk and somehow managed to create two new dashboards for my project.

Here is my requirement:

Dashboard 1 displays errors/exception/etc... in a stacked column chart (sorted based on different servers)

Clicking on the respective error/exceptions/etc... I need to be redirected to Dashboard 2 (sorted based on callouts) instead of the results page with logs.

Once we are on the second dashboard, clicking on the column should take us to the respective logs.

I am not a pro at this, tried searching a lot, but could not understand. Please suggest

• Praneeth

[lquinn · Accepted solution]

You need to include a drilldown option in your xml which specifies where you want the user to be redirected. The below lines need to be within the chart tags. So if you want users to be redirected to dashboard 2, you need to replace the following with the correct URL for dashboard 2:

<drilldown>
    <link>/app/your_app/dashboard_2</link>
</drilldown>

The following example is taken from the Splunk 6 Dashboard examples app (might be really useful to look at https://splunkbase.splunk.com/app/1603/). It redirects the user to the search page which displays a timechart for the the number of events in the _internal index from the past hour:

<drilldown>
    <link>/app/search/search?q=index%3D_internal%20earliest%3D-h%20%7C%20timechart%20count</link>
</drilldown>

Full chart example:

<chart>
    <search>
        <query>index=_internal |stats count by source</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
    </search>
    <option name="charting.chart">line</option>
    <drilldown>
        <link>/app/search/my_other_dashboard</link>
    </drilldown>
</chart>

[gcusello]

In addition I suggest to download the Splunk Dashboard Examples App from appbase at https://splunkbase.splunk.com/app/1603/ wher you can find an example of drilldown in adifferent dashboard or into the same dashboard.
Bye.
Giuseppe

[Kumar1980]

HI Cusello,

Thanks for the help, however i get an error when i added the suggested lines in the code

Error : Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 36: EntityRef: expecting ';'

I am not an expert at writing html codes, please suggest if i have committed any mistakes in the line below

 <link>/app/search/secure_5__backend_exceptions__callout_logs?earliest=0&latest=</link>

i have put the link to the dashboard with in the chart tags. My doubt is should i just copy the url for the dashboard or just the part that i have added as a link ?

• Praneeth

[gcusello]

Hi lquinn,
you should substitute & with &.
Bye.
Giuseppe

[Kumar1980]

Thanks Guys ,

This works good, i do see the desired results

🙂 thanks for your time and help, appreciate it

• Praneeth

[Kumar1980]

just to add ... the link is added with in the drilldown tags

[lquinn]

Its the & that is not allowed. Are you trying to specify the time picker settings for the secure_5_backend_exceptions_callout_logs dashboard, or do you just want to be taken to that page?

[Kumar1980]

HI,

I just want to be taken to the page

I already created two dashboards to display errors/exceptions in a column chart representation. one is sorted based on different servers and other based on callout logs (s1,s2,s3..... & callout1,callout2,...)

Once i click on a bar in the first dashboard it should redirect me to the second dashboard, upon clicking the respective column it should take us to the logs or the search

• Praneeth

[lquinn]

If you just want to go to the other dashboard, you don't need any of the part from the ? onwards, only the dashboard name. Give the following a try:

<link>/app/search/secure_5__backend_exceptions__callout_logs</link>

If this doesn't work, check that the url is correct for your dashboard. Do this by navigating to that dashboard and seeing what the url is when you are on that page - it should be exactly as above after http://your-splunk-server:8000/en-US/