Add Interactions to Your Cribl Search Dashboard

Enable Dashboard viewers to drill down into specific values in a visualization panel.

Why Use Interactions

​

Interactions enable Dashboard viewers to take action directly from visualizations. By selecting data points, users can trigger context-driven searches, follow external URLs, or open other Dashboards filtered by the selected value.

This helps you design a seamless workflow that connects your Dashboard to other Cribl or third-party tools and resources, resulting in a smooth data experience for people consuming your Dashboards.

Add a Dashboard Interaction

​

Dashboard Interaction Types

​

An Interaction controls what happens when a user selects a specific data point on your Dashboard. Each Interaction can trigger one of the following actions:

• Run a new search, filling the query with the value selected and other contextual information.
• Open an external link, enriching the URL with the selected value or with metadata about the user’s Cribl.Cloud Workspace.
• Open another Dashboard, populating one of its inputs with the selected value or other context.

Make a Visualization Run a Search on Click

​

You can configure a visualization so that selecting a data point triggers a new search.

You can fill the search query with:

• The value of the data point that the user selected, using the $value$ token.
• The name or value of the field that the user selected, using the $field.name$ or $field.value$ tokens.
• The value of a specific field in the selected row (regardless of which row cell the user clicked), using the $rowData.<fieldname>$ token.

To set up this Interaction:

1. Start adding or editing a Dashboard visualization panel.
2. At the bottom of the Edit Visualization drawer, select Interactions.
3. From the Action drop-down, select Run a new search.
4. Enter a search query. For example:

   dataset="cribl_search_sample"
    | where host=$value$ and $field.name$="$field.value$" and status=$rowData.status$

   Copy
5. When done, select Save at the top of the Dashboard.

For an Interaction to pass time parameters, it must either link to a Time Range input directly, or have no time picker at all. If an Interaction links to a parent search that has a time picker, it will fail.

Make a Visualization Open a URL on Click

​

You can configure a visualization so that selecting a data point opens an external link.

You can fill the URL with:

• The value of the data point that the user selected, using the $value$ token.
• The base URL of the user’s Cribl.Cloud Organization, using the $environment.baseUrl$ token.
• The name of the user’s Cribl.Cloud Workspace, using the $environment.workspace$ token.
• The type of the user’s Cribl.Cloud Workspace (development, staging, or production), using the $environment.type$ token.

To set up this Interaction:

1. Start adding or editing a visualization on your Dashboard.
2. At the bottom of the Edit Visualization drawer, select Interactions.
3. From the Action drop-down, select Open external link.
4. Enter a full URL. For example, you might want to check the reputation of the selected domain:

   https://www.virustotal.com/gui/domain/$value$

   Copy
5. When done, select Save at the top of the Dashboard.

Construct a URL That Includes Your Organization and Workspace

​

To construct a URL that includes your Cribl.Cloud Organization and Workspace, you can use the following Interaction tokens:

• $environment.workspace$ (the name of your Workspace).
• $environment.baseUrl$ (the base URL of your Organization).
• $environment.type$ (the type of your Workspace: development, staging, or production).

For example, if you configure an Open external link Interaction with this URL…

https://$environment.workspace$-$environment.baseUrl$-$environment.type$.cloud

…then when a user selects a data point in a Workspace named main, of type staging, in an Organization with the base URL amazing-heady-brcc3nr, the Interaction opens this URL:

https://main-amazing-heady-brcc3nr-staging.cloud

Make a Visualization Open Another Dashboard on Click

​

You can configure a visualization so that selecting a data point opens another Dashboard. You can also pass the selected value to one of the target Dashboard’s inputs, effectively filtering the new Dashboard by that value.

1. Start adding or editing a visualization on your Dashboard.
2. At the bottom of the Edit Visualization drawer, select Interactions.
3. From the Action drop-down, select Add value to dashboard input.
4. From the Dashboard drop-down, select the target Dashboard.
5. From the Input drop-down, select one of the target Dashboard’s inputs.
6. When done, select Save at the top of the Dashboard.

Dashboard Interaction Tokens Reference

​

Tokens are placeholders that get replaced with actual values when an Interaction is triggered.

For example, you might configure an Interaction to check the reputation of the clicked domain by opening an external link such as https://www.virustotal.com/gui/domain/$value$, and $value$ will get replaced with the actual domain selected.

A token can be a static value, such as a specific string, or dynamic, such as the value of a field in the data point selected.

You can use the following tokens in your Interactions:

$earliest$

​

The start timestamp of a time range to use with the timestats operator.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | timestats count by host | where _time >= $earliest$

…then when a user selects a data point and the current time range is earliest=1729290112 latest=1729376512, the Interaction runs this query:

dataset="cribl_search_sample" | timestats count by host | where _time >= 1729290112

$environment.baseUrl$

​

The base URL of the Cribl.Cloud Organization in which the user triggered the Interaction.

For example, if you configure an Open external link Interaction with this URL…

$environment.baseUrl$/status

…for an Organization with the base URL https://acme.cribl.cloud, the Interaction opens this URL:

https://acme.cribl.cloud/status

$environment.type$

​

The type of the Cribl.Cloud Workspace in which the user triggered the Interaction. Possible values are: development, staging, or production.

For example, if you configure an Open external link Interaction with this URL…

https://status.$environment.type$.example.com

…for a Workspace of type production, the Interaction opens this URL:

https://status.production.example.com

$environment.workspace$

​

The name of the Cribl.Cloud Workspace in which the user triggered the Interaction.

For example, if you configure a Open external link Interaction with this URL…

https://dashboards.example.com/$environment.workspace$

…for a Workspace named marketing, the Interaction opens this URL:

https://dashboards.example.com/marketing

$field.name$

​

The name of the field that the user selected.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | where $field.name$="foo"

…then when a user selects a field named host, the Interaction runs this query:

dataset="cribl_search_sample" | where host="foo"

$field.value$

​

The value of the field that the user selected.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | where status=$field.value$

…then when a user selects a field with the value 200, the Interaction runs this query:

dataset="cribl_search_sample" | where status="200"

$latest$

​

The end timestamp of a time range to use with the timestats operator.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | timestats count by host | where _time <= $latest$

…then when a user selects a data point and the current time range is earliest=1729290112 latest=1729376512, the Interaction runs this query:

dataset="cribl_search_sample" | timestats count by host | where _time <= 1729376512

$rowData.<fieldname>$

​

The value of a specific field in the row selected (regardless of which row cell the user clicked). Replace <fieldname> with an actual field name.

Example

​

If you configure the visualization above with a Run a new search Interaction like this…

dataset="cribl_search_sample" | where method=$rowData.method$ & count=$rowData.count_$

…then no matter whether the user selects count\_: 66 or method: GET, the Interaction runs a query with both:

dataset="cribl_search_sample" | where method=GET & count=66

$value$

​

The value of the data point that the user selected.

For example, if you configure a Run a new search Interaction with this query…

dataset="cribl_search_sample" | where host=$value$

…then when a user selects a data point with the value server1, the Interaction runs this query:

dataset="cribl_search_sample" | where host="server1"