Dashboards & Visualizations

Drill down into new visualization

bcusick
Communicator

Hi,

I have multiple timecharts on a dashboard. When I drill down on a certain result, the raw log shows up (normal). What I would like to do is have a table show up instead. I know I can use the "selected fields" option, but I would rather a table come up due to different fields for different searches. The goal is all about "user experience". Is this possible?

0 Karma
1 Solution

lguinn2
Legend

Yes! You can set up drill-down on a dashboard - in several ways. While another answer talks about customizing the flashtimeline view, there are much easier ways to customize your dashboard.

First, you can edit the visualization on the dashboard to control basic drilldown,but I think you have already done that.

Second, you can edit the simple XML underlying your dashboard and link the drilldown to a custom form or URL. Here is the section on drilldown in the documentation. I believe that this will do what you want, and it has a lot of flexibility.

A third option is to take even more control of the dashboard by converting it to advanced XML and then adding the drilldown as described here. I don't think this will be necessary to get what you want, though.

View solution in original post

lguinn2
Legend

Yes! You can set up drill-down on a dashboard - in several ways. While another answer talks about customizing the flashtimeline view, there are much easier ways to customize your dashboard.

First, you can edit the visualization on the dashboard to control basic drilldown,but I think you have already done that.

Second, you can edit the simple XML underlying your dashboard and link the drilldown to a custom form or URL. Here is the section on drilldown in the documentation. I believe that this will do what you want, and it has a lot of flexibility.

A third option is to take even more control of the dashboard by converting it to advanced XML and then adding the drilldown as described here. I don't think this will be necessary to get what you want, though.

somesoni2
Revered Legend

Before I answer this,
question1 = are your drilldown open flashtimeline (search app) view?
question2= if yes, the if its Ok for you to modify it or you're Ok to create a similar flashtimeline_custom view?

If both the answers are yes, You can change the default behaviour of flashtimeline (or flashtimeline_custom) by doing this.

Optional Step 1: clone flashtimeline into a new view flashtimeline_custom (if you want to keep it separate)
Step 2. Open the xml for flashtimeline (or urs new flashtimeline) and search for following entry

              <module name="ButtonSwitcher" layoutPanel="pageControls">
                <param name="mode">independent</param>
                <param name="hideChildrenOnLoad">True</param>
                <param name="selected">splIcon-events-list</param>

Step 3. On the last entry (param name=selected), change the value from splIcon-events-list to splIcon-results-table. and you are all set. You flashtimeline will now show results in table view by default.

Options Step 3: If you have created a flashtimeline_custom, change the drilldown Redirector module to point to flashtimeline_custom.
Change

  <module name="Redirector">
    <param name="url">flashtimeline</param>

To

<module name="Redirector">
<param name="url">flashtimeline_custom</param>
0 Karma
Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...