Enable Dashboard viewers to drill down into specific values in a visualization panel.

Why Use Dashboard Interactions

​

Interactions enable Dashboard viewers to take action directly from visualizations. By clicking on data points, users can trigger context-driven searches, follow external URLs, or open other Dashboards filtered by the value clicked.

This helps you design a seamless workflow that connects your Dashboard to other Cribl or third-party tools and resources, resulting in a smooth data experience for people consuming your Dashboards.

Dashboard Interaction Types

​

An Interaction controls what happens when you click on a specific data point on your Dashboard. Each Interaction can trigger one of the following actions:

• Run a new search, filling the query with the value clicked and other contextual information.
• Open an external link, enriching the URL with the value clicked or with metadata about the user’s Cribl.Cloud Workspace.
• Open another Dashboard, populating one of its Inputs with the value clicked or other context.

Add a Dashboard Interaction

​

Run a New Search From a Visualization

​

You can set up a visualization so that clicking on it runs a new search.

For this, add a Run a New Search Interaction:

1. Start adding or editing a Dashboard visualization panel.
2. At the bottom of the Edit Visualization drawer, select Interactions.
3. From the Action drop-down, select Run a new search.
4. Enter your search query. (See the examples below.)
5. At the top of the Dashboard, select Save.

Your search query can reference the following tokens:

• $earliest$
• $environment.baseUrl$
• $environment.type$
• $environment.workspace$
• $field.name$
• $field.value$
• $latest$
• $rowData.<fieldname>$
• $value$

dataset="users" email=$value$ | project id, email, last_login

dataset="users" email="sam@example.com" | project id, email, last_login

https://<yourWorkspace>-<yourCloudInstance>.cribl.cloud/search/new?q=dataset%3D%22users%22%20email%3D%22sam%40example.com%22%20%7C%20project%20id%2C%20email%2C%20last_login&et=-1h&lt=now&run=true

dataset="cribl_search_sample"
 | where host==$value$ and $field.name$=="$field.value$" and status==$rowData.status$

dataset="cribl_search_sample"
 | where host==server1 and email=="sam@example.com" and status==200

https://<yourWorkspace>-<yourCloudInstance>.cribl.cloud/search/new?q=dataset%3D%22cribl_search_sample%22%20%7C%20where%20host%3D%22server1%22%20and%20email%3D%22sam%40example.com%22%20and%20status%3D200&et=-1h&lt=now&run=true

For an Interaction to pass time parameters, it must either link to a Time Range Input directly, or have no time picker at all. If an Interaction links to a parent search that has a time picker, it will fail.

Open a URL From a Visualization

​

You can set up a visualization so that clicking on it opens an external URL.

For this, add an Open External Link Interaction:

1. Start adding or editing a visualization on your Dashboard.
2. At the bottom of the Edit Visualization drawer, select Interactions.
3. From the Action drop-down, select Open external link.
4. Enter a URL. (See the example below.)
5. At the top of the Dashboard, select Save.

The URL can reference the following tokens:

• $earliest$
• $environment.baseUrl$
• $environment.type$
• $environment.workspace$
• $field.name$
• $field.value$
• $latest$
• $rowData.<fieldname>$
• $value$

Example

​

If you configure an Open external link Interaction with this URL…

https://www.virustotal.com/gui/domain/$value$

…then clicking on a data point with the value of server1 opens this URL:

https://www.virustotal.com/gui/domain/server1

Include Your Organization and Workspace in a URL

​

To construct a URL that includes your Cribl.Cloud Organization and Workspace, use the $environment.baseUrl$ token.

For example, if you configure an Open external link Interaction with this URL…

$environment.baseUrl$

…then clicking on the visualization in a Workspace named main, in an Organization called amazing-heady-brcc3nr, opens this URL:

https://main-amazing-heady-brcc3nr.cribl.cloud

Open Another Dashboard From a Visualization

​

You can set up a visualization so that clicking on it opens another Dashboard.

You can also pass the value clicked to one of the target Dashboard’s Inputs, effectively filtering the new Dashboard by that value.

1. Start adding or editing a visualization on your Dashboard.
2. At the bottom of the Edit Visualization drawer, select Interactions.
3. From the Action drop-down, select Add value to dashboard input.
4. From the Dashboard drop-down, select the target Dashboard.
5. From the Input drop-down, select one of the target Dashboard’s Inputs.
6. At the top of the Dashboard, select Save.

Dashboard Interaction Tokens Reference

​

Tokens are placeholders that get replaced with actual values when an Interaction is triggered.

A token can be a static value, such as a specific string, or dynamic, such as the value of a field that was clicked.

You can use the following tokens in your Interactions:

$earliest$

​

The start timestamp of a time range to use with the timestats operator.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | timestats count by host | where _time >= $earliest$

…and the current time range is earliest=1729290112 latest=1729376512, clicking the visualization triggers this query…

dataset="cribl_search_sample" | timestats count by host | where _time >= 1729290112

…encoded in this URL:

https://<yourWorkspace>-<yourCloudInstance>.cribl.cloud/search/new?q=dataset%3D%22cribl_search_sample%22%20%7C%20timestats%20count%20by%20host%20%7C%20where%20_time%20%3E%3D%201729290112&et=-1h&lt=now&run=true

$environment.baseUrl$

​

The fully qualified base URL of the Cribl.Cloud Organization in which the user triggered the Interaction.

The base URL includes:

• https:// prefix
• Workspace name ($environment.workspace$)
• Organization ID (e.g., amazing-heady-brcc3nr)
• Environment type ($environment.type$)
• cribl.cloud suffix

For example, if you configure an Open external link Interaction with this URL…

$environment.baseUrl$/status

…for an Organization with the base URL https://main-amazing-heady-brcc3nr.cribl.cloud, the Interaction opens this URL:

https://main-amazing-heady-brcc3nr.cribl.cloud/status

$environment.type$

​

The type of the Cribl.Cloud Workspace in which the user triggered the Interaction. Possible values are: development, staging, or production.

For example, if you configure an Open external link Interaction with this URL…

status.$environment.type$.example.com

…for a Workspace of type production, the Interaction opens this URL:

status.production.example.com

$environment.workspace$

​

The name of the Cribl.Cloud Workspace in which the user triggered the Interaction.

For example, if you configure a Open external link Interaction with this URL…

dashboards.example.com/$environment.workspace$

…for a Workspace named marketing, the Interaction opens this URL:

dashboards.example.com/marketing

$field.name$

​

The name of the field clicked.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | where $field.name$="foo"

…then clicking on a field named host triggers this query…

dataset="cribl_search_sample" | where host="foo"

…encoded in this URL:

https://<yourWorkspace>-<yourCloudInstance>.cribl.cloud/search/new?q=dataset%3D%22cribl_search_sample%22%20%7C%20where%20host%3D%22foo%22&et=-1h&lt=now&run=true

$field.value$

​

The value of the field clicked.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | where status=$field.value$

…then clicking on a field with the value 200 triggers this query…

dataset="cribl_search_sample" | where status="200"

…encoded in this URL:

https://<yourWorkspace>-<yourCloudInstance>.cribl.cloud/search/new?q=dataset%3D%22cribl_search_sample%22%20%7C%20where%20status%3D%22200%22&et=-1h&lt=now&run=true

$latest$

​

The end timestamp of a time range to use with the timestats operator.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | timestats count by host | where _time <= $latest$

…and the current time range is earliest=1729290112 latest=1729376512, clicking the visualization triggers this query…

dataset="cribl_search_sample" | timestats count by host | where _time <= 1729376512

…encoded in this URL:

https://<yourWorkspace>-<yourCloudInstance>.cribl.cloud/search/new?q=dataset%3D%22cribl_search_sample%22%20%7C%20timestats%20count%20by%20host%20%7C%20where%20_time%20%3C%3D%201729376512&et=-1h&lt=now&run=true

$rowData.<fieldname>$

​

The value of a specific field in the clicked row (regardless of which row was actually clicked). Replace <fieldname> with a real field name.

Example

​

If you configure the visualization above with a Run a new search Interaction like this…

dataset="cribl_search_sample" | where method=$rowData.method$ & count=$rowData.count_$

…then no matter whether the user selects count\_: 66 or method: GET, the Interaction runs a query with both…

dataset="cribl_search_sample" | where method=GET & count=66

…encoded in this URL:

https://<yourWorkspace>-<yourCloudInstance>.cribl.cloud/search/new?q=dataset%3D%22cribl_search_sample%22%20%7C%20where%20method%3DGET%20%26%20count%3D66&et=-1h&lt=now&run=true

$value$

​

The value of the data point clicked.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | where host=$value$

…then clicking on a data point with the value of server1 triggers this query…

dataset="cribl_search_sample" | where host="server1"

…encoded in this URL:

https://<yourWorkspace>-<yourCloudInstance>.cribl.cloud/search/new?q=dataset%3D%22cribl_search_sample%22%20%7C%20where%20host%3D%22server1%22&et=-1h&lt=now&run=true