Splunk Enterprise

drilldown on dropdown ?

jiaqya
Builder

is it possible to drilldown to a new panel/page on selecting an option from drop down ?

if not possible, any alternate suggestions how to achieve this ?

Tags (1)
0 Karma
1 Solution

elliotproebstel
Champion

The most "Splunk way" to do this would be to add navigation elements into the menu at the top of the page. This bar is what I'm talking about modifying:

alt text

You can modify what's displayed there by editing the Navigation Menu XML at
Settings > User Interface > Navigation Menus > default (for appropriate app)

If your Navigation menu currently looks like the one I posted, then the XML will look like this:

<nav search_view="search" color="#65A637">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
</nav>

If you have two dashboards named primary_dashboard and secondary_dashboard, you could either add them individually to the navigation menu bar by editing the XML to look like this:

<nav search_view="search" color="#65A637">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
  <view name="primary_dashboard" />
  <view name="secondary_dashboard" />
</nav>

Alternately, if you wanted them to be grouped together and have a little drop-down menu from which the user can select either dashboard, you use the <collection> element. So maybe you'd want them both grouped under the heading Most Useful Dashboards, then your code would look like this:

<nav search_view="search" color="#65A637">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
  <collection label="Most Useful Dashboards">
    <view name="primary_dashboard" />
    <view name="secondary_dashboard" />
  </collection>
</nav>

View solution in original post

0 Karma

niketn
Legend

@jiaqya, you can try the Run anywhere example posted on the answer below for various Navigation options in Splunk. You can use Prebuilt HTML Panel with CSS to Generate multi-level Cascaded Navigation menu as explained in the answer.

https://answers.splunk.com/answers/595047/can-we-implement-cascading-dropdowns-in-a-dashboar.html

Also requesting you to post comment below the answer/comment already present instead or posting a new answer to your own question.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jiaqya
Builder

Hi Niket, i tried your solution as well and it worked great.
but i think it was better to view it on the navigation bar than on the html drop down below.
i may however have use for this in the future, thanks for sharing..

i can only mark 1 answer as Accept.

John.

0 Karma

niketn
Legend

@jiaqya, My answer on the link above has four options including the Navigation XML editing, that has worked for you. You can definitely up vote the answer if it helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jiaqya
Builder

Done, thanks

0 Karma

elliotproebstel
Champion

The most "Splunk way" to do this would be to add navigation elements into the menu at the top of the page. This bar is what I'm talking about modifying:

alt text

You can modify what's displayed there by editing the Navigation Menu XML at
Settings > User Interface > Navigation Menus > default (for appropriate app)

If your Navigation menu currently looks like the one I posted, then the XML will look like this:

<nav search_view="search" color="#65A637">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
</nav>

If you have two dashboards named primary_dashboard and secondary_dashboard, you could either add them individually to the navigation menu bar by editing the XML to look like this:

<nav search_view="search" color="#65A637">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
  <view name="primary_dashboard" />
  <view name="secondary_dashboard" />
</nav>

Alternately, if you wanted them to be grouped together and have a little drop-down menu from which the user can select either dashboard, you use the <collection> element. So maybe you'd want them both grouped under the heading Most Useful Dashboards, then your code would look like this:

<nav search_view="search" color="#65A637">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
  <collection label="Most Useful Dashboards">
    <view name="primary_dashboard" />
    <view name="secondary_dashboard" />
  </collection>
</nav>
0 Karma

jiaqya
Builder

Elliot, Thanks , this may be probably what i am looking for, ill try this and get back if it worked for me.

john.

0 Karma

jiaqya
Builder

Elliot, i did what you suggested above, but i dont see a new option called " Most Usedful Dashboards". i havent tried restarting the service, just checking if this requires a service restart ?

0 Karma

elliotproebstel
Champion

No, there should be no need to restart the service. It will only appear in the app for which you modified the default.xml file. When you go to Settings > User Interface > Navigation Menus and then select a default option, the row for that option will also tell you which app it applies to. Have you ensured that you modified the default.xml file for the app you want to use? If you're confident it's for the right app, perhaps you could post the XML code from default.xml and I could help you look for a typo.

0 Karma

jiaqya
Builder

i was missing the view, i created the view and now i can see them.
i believe this has fixed my initial problem. thank you Eliott

John.

0 Karma

jiaqya
Builder

ok good to know that, i tried it before but it didnt work , below is the test code..

clientdb

<input type="dropdown" token="product_name">
  <label>field1</label>
  <choice value="1">test</choice>
  <choice value="2">test2</choice>
  <fieldForLabel>bang</fieldForLabel>
  <fieldForValue>bang</fieldForValue>
  <search>
    <query>index = _internal | stats count by sourcetype</query>
  </search>
  <drilldown target="My New Window">
    <link>/app/dashboard_examples/form_table2?form.sourcetype=$row.sourcetype$</link>
  </drilldown>
</input>


<panel>
  <table>
    <search>
      <query>index=test</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
  </table>
</panel>
0 Karma

jiaqya
Builder

https://answers.splunk.com/answers/129148/simple-xml-drilldown-to-new-window.html

this works if I already have a visual item.. I can then set the redirect on that item to a new page.
I have it working on many of my dashboards.

my issue is that when I select an option from drop down , suppose drop down has 2 options 1 and 2. and if I select 1 from the drop down it should redirect to a new page.. is that possible ? I hope my question is understood..

0 Karma

jiaqya
Builder

https://answers.splunk.com/answers/129148/simple-xml-drilldown-to-new-window.html

this works if I already have a visual item.. I can then set the redirect on that item to a new page.
I have it working on many of my dashboards.

my issue is that when I select an option from drop down , suppose drop down has 2 options 1 and 2. and if I select 1 from the drop down it should redirect to a new page.. is that possible ? I hope my question is understood..

0 Karma

jiaqya
Builder

No submit button, require it to redirect , when i select an option from drop down...directly

0 Karma

jiaqya
Builder

i am already using this code with visualization items or columns which are already present.

does this work with selecting an option on the dropdown ? i tried to use it an it didnt work.

0 Karma

mayurr98
Super Champion

yes it works with the drop-down as well.

0 Karma

mayurr98
Super Champion

Is this what you are looking for?

 <drilldown target="My New Window">
       <link>
          /app/dashboard_examples/form_table2?form.sourcetype=$row.sourcetype$
        </link>
  </drilldown>   

http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Dynamicdrilldownindashboardsandforms

Within the tag, optionally specify a target= attribute if you wish to direct the drilldown destination. (defaults to: target="_self" - and the link will open in the current window)

0 Karma

jiaqya
Builder

Mayur, i would give a try with your suggestion as well and get back..

0 Karma

mayurr98
Super Champion

create a new dashboard and see if this xml can help you!

<form>
   <label>business metrics</label>
   <fieldset submitButton="false" autoRun="true">
     <input type="dropdown" token="app_family" searchWhenChanged="true">
       <label>Select Application Family</label>
       <search>
         <query>| gentimes start=-1 | eval temp="app_fam1,app_name1  app_fam1,app_name2  app_fam2,app_name3  app_fam2,app_name4" | table temp | makemv temp | mvexpand temp | rex field=temp "(?&lt;App_Family&gt;.*),(?&lt;Application&gt;.*)" | table App_Family | dedup App_Family</query>
         <earliest>0</earliest>
       </search>
       <fieldForLabel>App_Family</fieldForLabel>
       <fieldForValue>App_Family</fieldForValue>
       <populatingSearch fieldForLabel="App_Family" fieldForValue="App_Family">| gentimes start=-1 | eval temp="app_fam1,app_name1  app_fam1,app_name2  app_fam2,app_name3  app_fam2,app_name4" | table temp | makemv temp | mvexpand temp | rex field=temp "(?&lt;App_Family&gt;.*),(?&lt;Application&gt;.*)" | table App_Family | dedup App_Family</populatingSearch>
     </input>
     <input type="dropdown" token="app" searchWhenChanged="true">
       <label>Select Application</label>
       <search>
         <query>| gentimes start=-1 | eval temp="app_fam1,app_name1  app_fam1,app_name2  app_fam2,app_name3  app_fam2,app_name4" | table temp | makemv temp | mvexpand temp | rex field=temp "(?&lt;App_Family&gt;.*),(?&lt;Application&gt;.*)" | where App_Family="$app_family$" | table Application</query>
         <earliest>0</earliest>
       </search>
       <fieldForLabel>Application</fieldForLabel>
       <fieldForValue>Application</fieldForValue>
       <populatingSearch fieldForLabel="Application" fieldForValue="Application">| gentimes start=-1 | eval temp="app_fam1,app_name1  app_fam1,app_name2  app_fam2,app_name3  app_fam2,app_name4" | table temp | makemv temp | mvexpand temp | rex field=temp "(?&lt;App_Family&gt;.*),(?&lt;Application&gt;.*)" | where App_Family="$app_family$" | table Application</populatingSearch>
     </input>
   </fieldset>
    <row>
     <panel>
       <table depends="$app$">
         <title>Launcher</title>
         <searchString>| gentimes start=-1 | eval Launcher="Click Here to Launch the Dashboard" | table Launcher</searchString>
         <earliestTime>0</earliestTime>
         <latestTime/>       
         <option name="wrap">true</option>
         <option name="rowNumbers">false</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <drilldown>
           <link>
              <![CDATA[
 /app/YourAppNameHere/business_metrics_$app$?form.app_family=$app_family$&form.app=$app$
   ]]>
           </link>
         </drilldown>
         <option name="count">10</option>
       </table>
     </panel>
   </row>
 </form>
0 Karma

jiaqya
Builder

thanks, looking to drilldown to a new page, how to do it ?

0 Karma

493669
Super Champion

so are you expect if any value is selected in dropdown then it should navigate to new dashboard? is there any specific reason?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...