Spread our blog

Dynamically Panel Title Change Using Drill-down In Splunk

Hi, Today we are here with another useful trick of Splunk. Now, what is it let’s take an example, Suppose you have a drill-down panel enabled for a panel in your dashboard and you want to change the drill-down panel title dynamically with the drill-down token.
1st Scenario: Now we will start with the basic one then we will try a interesting one at last.
Step 1:
We have a dashboard called Demo_dashboard which is built with a Table panel (i.e. is a tabular view of method, status, and count field).

Step 2:
Now we will create a simple drill-down panel of this which will consist of “method” and “host” field.
We have used here “$click.value$” token for this use case.
If you don’t know how to create drill-down panel then just follow this blog :

How To Use Drilldown Token ($click.value$ and $click.value2$) In Splunk

As you can see that in the main panel we have  a “drilldown” tag, which is for enabling drill-down, and we have created a token “aa” which will passed the value of method field through the drill-down in the last panel.
If you save this it will look like this.

Step 3:
Now within that “aa” token values of “method” field are passing, if you click on that row where it has “method=GET” then within that token “GET” value will pass. Now, what if I want that token value to be the title of the drill-down panel i.e. if I click on “GET” then the title of the drill-down panel should consist “GET”.
Suppose, we want the drill-down panel title as “Name of the host for GET”, the last potion should change dynamically if I click on HEAD then it should show as “Name of the host for HEAD
For this, we will do a small change, we will pass that “aa” token into the drill-down panel title. Which is as follows.
Click on Edit and write on the drill-down panel title.
Name of the host for “$aa$”

And Save it, see the changes.
To download the complete source code click here.

2nd Scenario: Now this time we will do a bit different whenever we will select GET it should reflect as “READ” in the drill-down panel title, For HEAD it should “HEADERS”, for DELETE it should be “REMOVED” ad for POST it should be “WRITE”.
We want the panel title as “Hostname for the “READ” operation”, the last portion should change dynamically if I click on HEAD then it should show as “Hostname for the “HEADERS” operation”.
It seems to be difficult, don’t worry we will help you out.
It will be the same upto STEP 2 as shown in the previous case.
Step 3:
Click on Edit and go to the source code.

Step 4:
Within the source code do the following changes as shown.
In the main panel within the “drilldown” tag create a new tag known as “eval” tag. There we have used a “case” function, i.e. the condition is whenever the token value “aa” will consist any of those following method values GET, POST, HEAD and DELETE it substitute with READ, WRITE, HEADERS and REMOVED respectively and that value will store within the “bb” token, which is mentioned within the “eval” tag.
After that in the title section of drill-down panel we will pass the “bb” token. Write: “Hostname for the “$bb$” operation”
Now save this and you can see the changes.

You can also know about :  How to add Serial Number in each line of your event

To download the complete source code click here

I hope you all have understood this topic on: Dynamically Panel Title Change Using Drill-down In Splunk

Happy Splunking!!

What’s your Reaction?

Spread our blog


Please enter your comment!
Please enter your name here