Dynamic Drilldown with Trellis-Style Single Value Chart

anholzer — Mon, 27 Jan 2020 21:52:24 GMT

I am trying to create a dynamic dashboard utilizing splunk's custom token capability. I have a single value panel that is broken out in trellis format. The query for this panel is fairly simple: index = a sourcetype= b | stats avg(c) by d.

What I want is to have additional panels that will display information based on which trellis shape is chosen (aka a value of d).

For example the trellis format would have 3 boxes with values like abc (title) = 123 (value) , def = 3.33, ghi = 8.56. I want to be able to click on the box with title ghi and value 8.56 and show additional panels that include [d = ghi] in the panels query.

Does anyone know of a way to reference those values? I've tried using $click.name2$, $click.value2$, $results.d$ and some others...

TLDR:
When you set up the splunk auto drilldown search it gives me the value of d that I desire, but I can't recreate it using other dynamic drilldown options.

Re: Dynamic Drilldown with Trellis-Style Single Value Chart

anholzer — Mon, 27 Jan 2020 22:09:41 GMT

Actually - just figured it out. Posting reply in case others have this issue as well -

You can use the token = $trellis.value$ for searching on trellis split charts.

Happy Splunking!

topic Re: Dynamic Drilldown with Trellis-Style Single Value Chart in Dashboards & Visualizations

Dynamic Drilldown with Trellis-Style Single Value Chart

Re: Dynamic Drilldown with Trellis-Style Single Value Chart