Dashboards & Visualizations

Base search to use in a new window as a drilldown dashboard

Nadhiya123
Explorer

Hello All,

Is there a way to put a base search in the first dashboard which drilldowns to a new dashboard where it uses the base search from the first dashboard.

0 Karma

niketn
Legend

@Nadhiya123, how many base searches are being passed from one dashboard to another? What may vary in your base searches. Can you give examples of base search from first dashboard?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Nadhiya123
Explorer

@niketn

There is one search which i use to display a map in my first dashboard.

it drilldowns to the new next dashboard based on the lat/lon,

base search in 1st map dashbaord:
......
.......| stats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG
| geostats max(sessions) as sessions, max(X) as X, max(Y) as Y latfield=LAT longfield=LNG outputlatfield=LAT outputlongfield=LNG globallimit=0 | eval High_No_Of_Calls = if(sessions > $HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <= $Medium$,sessions,0)
| fields - sessions, X, Y

drilldown search 1:
.........
......| stats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG | eval High_No_Of_Calls = if(sessions > $HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <=$Medium$,sessions,0) | fields - sessions, X, Y| where LAT>=$lattitude1$ AND LAT<$lattitude2$ AND LNG>=$longitude1$ AND LNG<$longitude2$|table NPANXX,High_No_Of_Calls,Medium_No_Of_Calls,Normal_No_Of_Calls|where (High_No_Of_Calls=$High$ AND Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$) |head 1|eval High_No_Of_Calls=$High$|eval Medium_No_Of_Calls=$Med$|eval Normal_No_Of_Calls=$Normal$|table NPANXX,High_No_Of_Calls,Medium_No_Of_Calls,Normal_No_Of_Calls

drilldownsearch 2:

| eventstats max("count(xx)") as sessions, max(upperBound) as X, max(lowerBound) as Y by NPANXX,LAT,LNG | eval High_No_Of_Calls = if(sessions >$HIGH$,sessions,0)
| eval Medium_No_Of_Calls = if((sessions > $Medium$ AND sessions < $HIGH$ ),sessions,0) | eval Normal_No_Of_Calls = if(sessions <=$Medium$,sessions,0) | fields - sessions, X, Y| where LAT>=$lattitude1$ AND LAT<$lattitude2$ AND LNG>=$longitude1$ AND LNG<$longitude2$
|table _time,....|where (High_No_Of_Calls=$High$ AND Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$) OR (Medium_No_Of_Calls=$Med$ AND Normal_No_Of_Calls=$Normal$)|sort - _time|eval m=max($High$,$Med$,$Normal$) | streamstats c | where c<=m|table ....
Trying to work on the performance issue.

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Nadhiya123,
you can pass as token a search from the first dashboard to the second but only if it's not so long because there are limits to url lenght.
Anyway do you want to pass a fixed search or a different one depending by the click on the first dashboard panel?
Maybe you could create secondary dashboard search passing as token only parameters.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...