topic Re: How do I get a single value drilldown to a table? in Dashboards & Visualizations

How do I get a single value drilldown to a table?

MarcoG17 — Mon, 18 Feb 2019 22:50:44 GMT

I have a single value panel that shows me the number of events by user. I want to create a drilldown when I click on the single value that displays a new panel in table format and lists the users and other details. I created a token, but I can't seem to get it to pull any user information.

    <panel>
      <title>Users Deleted (last 30 days)</title>
      <single>
        <search>
          <query>index=windows sourcetype="wineventlog" source="wineventlog:security" EventCode="4726" NOT User="*$" | stats dc(user) AS "User Events"</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="USER">$row.user$</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$USER$">
      <title>User Details</title>
      <table>
        <search>
          <query>index=windows sourcetype="wineventlog" source="wineventlog:security" user="$USER$" | table user</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</dashboard>

Re: How do I get a single value drilldown to a table?

renjith_nair — Tue, 19 Feb 2019 03:31:26 GMT

@MarcoG17

Your field name in search is User Events and you are trying to set the token to user
i.e. stats dc(user) AS "User Events" vs $row.user$

Try changing the search to

stats dc(user) AS user

Re: How do I get a single value drilldown to a table?

MarcoG17 — Tue, 19 Feb 2019 15:06:15 GMT

makes sense i did what you said but when i click on the single value number it still doesn't show the user name in the table.

Re: How do I get a single value drilldown to a table?

Vijeta — Tue, 19 Feb 2019 15:23:40 GMT

@MarcoG17- Your first query should be

stats dc(user) AS "User Events" by User| fields "User Events" , User

Re: How do I get a single value drilldown to a table?

MarcoG17 — Tue, 19 Feb 2019 19:58:35 GMT

this displays the users instead of the number in the single value panel. Not working as i would imagine.

Re: How do I get a single value drilldown to a table?

renjith_nair — Sat, 23 Feb 2019 07:22:54 GMT

@MarcoG17,
Click on the search icon under the table panel and see what search it has executed. This would help us to find what value is passed and why no result is retrieved for that user.