Hi,
I need to create a drilldown for my dashboard. I need to give the ability to the user to click on a value, and then run a new query and use the value that returned from the query to open a new web page with the value returned from the new query.
example:
I have the following table:
I want to exclude the "Drilldown ID" field from the table, and give the user the option to click on a record and another web page will be opened. I need the "Drilldown ID" field to be in the url of the new web page opened, but I dont want it in my table results.
Is that possible?
Thanks
@matansocher, Splunk 6.x Dashboard Examples App
has "Table Element with Hidden Fields" example which explains the exact use case. @cmerriman has taken Splunk Simple XML configuration which lets you do this. However, if you want to hide a table field and still use the same for drilldown, you should try the following two steps:
Step 1: Use fields
in Simple XML to remove "Drilldown ID"
from being displayed in the table.
<fields>["ID", "Queue", "Date Created"]</fields>
Step 2: Use predefined table token $row.$ for <drilldown>
$row.Drilldown ID$
Following is a run anywhere dashboard with mocked data and drilldown to URL just to display the token in a new browser window.
<dashboard>
<label>Table hide field use in drilldown</label>
<row>
<panel>
<table>
<search>
<query>| makeresults
| eval "Drilldown ID"="somehexguid12ab1234",ID="INC1234567",Queue="Windows","Date Created"="2017-06-13"
| append
[| makeresults
| eval "Drilldown ID"="somehexguid45cd4321",ID="INC7654321",Queue="HW","Date Created"="2017-06-19"]
| table "Drilldown ID", "ID", "Queue", "Date Created"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>["ID", "Queue", "Date Created"]</fields>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<link target="_blank">http://answers.splunk.com/$row.Drilldown ID$</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
@matansocher, Splunk 6.x Dashboard Examples App
has "Table Element with Hidden Fields" example which explains the exact use case. @cmerriman has taken Splunk Simple XML configuration which lets you do this. However, if you want to hide a table field and still use the same for drilldown, you should try the following two steps:
Step 1: Use fields
in Simple XML to remove "Drilldown ID"
from being displayed in the table.
<fields>["ID", "Queue", "Date Created"]</fields>
Step 2: Use predefined table token $row.$ for <drilldown>
$row.Drilldown ID$
Following is a run anywhere dashboard with mocked data and drilldown to URL just to display the token in a new browser window.
<dashboard>
<label>Table hide field use in drilldown</label>
<row>
<panel>
<table>
<search>
<query>| makeresults
| eval "Drilldown ID"="somehexguid12ab1234",ID="INC1234567",Queue="Windows","Date Created"="2017-06-13"
| append
[| makeresults
| eval "Drilldown ID"="somehexguid45cd4321",ID="INC7654321",Queue="HW","Date Created"="2017-06-19"]
| table "Drilldown ID", "ID", "Queue", "Date Created"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>["ID", "Queue", "Date Created"]</fields>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<link target="_blank">http://answers.splunk.com/$row.Drilldown ID$</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
Thank you!!
This is definitely possible!
add something like this to your source code after the </search>
tag:
<drilldown>
<link target="_blank">URL with token like this $row.drilldownid$</link>
</drilldown>
you might want to add a new field that copies drilldown id for the token.
|eval drilldownid='Drilldown ID'
or something similar in your search
you can use this in your source code to not include it in your panel (also after the </search>
tag)
<fields>["Drilldown ID","ID","Queue","Date Created"]</fields>
I have managed to do this with that way, but I need my table not to include the field "Drilldown ID".
I want to look for it in another search and then open a new web page with that value.
Oh, I'm sorry, I missed that there was a search in between this one and the webpage.
for drilldown reference:
http://docs.splunk.com/Documentation/Splunk/6.6.3/Viz/EventHandlerReference#Drilldown_event_tokens
so for the first panel, if you're linking it to another panel in the dashboard, you could do something like:
<drilldown>
<set token="drilldownid">$row.drilldownid$</set>
</drilldown>
and then in that panel, use $drilldownid$
in the search and set
<drilldown>
<link target="_blank">URL with token like this $row.fieldname$</link>
</drilldown>
if you want to hide the second panel before clicking on the Drilldown ID, you can add depends="$drilldownid$"
in the <panel>
tag of the second panel
Thank you for your answer, it was really helpfull. I finally decided to use niketnilay's answer, it really simplified my needs.