Dashboards & Visualizations

How do I display the collection of events (as a drill down) present inside a transaction by clicking on the row (transaction table) in the main dashboard.

pkol
Explorer

I want to display all the events present inside a transaction on the main dashboard by clicking on the transaction row in the table , but I am not able to return that specific transaction events and instead returning all the transactions related to that source.

So essentially, I need to see all the events present inside the clicked row (transactions) in the form of a drill down of events.
Can someone point me in the right direction please.
Thank you.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi pkol,
could you share your search?
Anyway, I suggest to create two panels in a dashboard, in the main panel you insert your search.
Then you can pass as token/s the field/s you used to create your transaction to the secondary panel and display the events that are in the transaction.
To know how to pass a token from a panel to another in the same dashboard, see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Anyway, if you created your transaction using a field as transaction id, I suggest to explore a different approach because the transaction command is very slow!
e.g. if you have something like this

index=my_index
| transaction trans_id
| table _time trans_id field1 field2

you can change in

index=my_index
| stats earliest(_time) AS _time values(field1) AS field1 values(field2) AS field2 count BY trans_id

that is very faster than the other.

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi pkol,
could you share your search?
Anyway, I suggest to create two panels in a dashboard, in the main panel you insert your search.
Then you can pass as token/s the field/s you used to create your transaction to the secondary panel and display the events that are in the transaction.
To know how to pass a token from a panel to another in the same dashboard, see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Anyway, if you created your transaction using a field as transaction id, I suggest to explore a different approach because the transaction command is very slow!
e.g. if you have something like this

index=my_index
| transaction trans_id
| table _time trans_id field1 field2

you can change in

index=my_index
| stats earliest(_time) AS _time values(field1) AS field1 values(field2) AS field2 count BY trans_id

that is very faster than the other.

Bye.
Giuseppe

pkol
Explorer

THANK YOU , I FIGURED IT OUT!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...