topic Re: Adding drilldown to trellis layout in Dashboards & Visualizations

Adding drilldown to trellis layout

ritupatil02 — Fri, 18 Jun 2021 06:15:37 GMT

How to add drilldown to the split visualisation in trellis layout?

I tried using this but it didn't work out

<set token="selected_value">$trellis.value$</set>

</drilldown>

Is there any other way to achieve this?

Here's my XML:

<row>
<panel id="table1">
<title>Asset Hierarchy - ($name1$)</title>
<single id="test10">
<title>Percentage</title>

<search>
<query>$envInput$ sourcetype="meridium:assethierarchy" appn="APM - Meridium"
| stats count by lvl
| eventstats sum(count) as total
| eval count=100*count/total
| fields - total
| transpose header_field=lvl column_name=lvl
| fields - lvl</query>
<earliest>$timeInput.earliest$</earliest>
<latest>$timeInput.latest$</latest>
</search>
<option name="drilldown">all</option>
<option name="height">130</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0xdc4e41","0x53a051","0xf1813f","0x3c444d","0x3c444d"]</option>
<option name="trellis.enabled">1</option>
<option name="unit">%</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<link target="_blank">search?q=$envInput$%20sourcetype%3D%22meridium%3Aassethierarchy%22%20appn%3D%22APM%20-%20Meridium%22&earliest=$timeInput.earliest$&latest=$timeInput.latest$</link>
</drilldown>
</single>
</html>

Re: Adding drilldown to trellis layout

kamlesh_vaghela — Fri, 18 Jun 2021 06:33:18 GMT

@ritupatil02

Can you please check this?

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/VisualizationTrellis#Predefined_tokens_for_trellis_split_fields

Please let me know if you face any difficulties.

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Adding drilldown to trellis layout

ritupatil02 — Fri, 18 Jun 2021 08:36:14 GMT

Exactly where do we add "$trellis.value$" ?

Re: Adding drilldown to trellis layout

kamlesh_vaghela — Mon, 21 Jun 2021 07:38:28 GMT

@ritupatil02

to have trelliss value you need to modify little bit your search. Please check below XML.

<dashboard> <label>Single View</label> <row> <panel> <single id="singleTrellis1"> <search> <query>| makeresults count=10 | eval a=1 | accum a | eval lvl=case(a%3==0,"Error",a%3==1,"Info",a%3==2,"Warn") | stats count by lvl | eventstats sum(count) as total | eval count=(100*count/total). "%" | fields - total</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <option name="trellis.size">medium</option> <drilldown> <condition match="$trellis.value$="Error""> <set token="tkn_search">SET_YOUR_SEARCH $trellis.value$</set> </condition> <condition match="$trellis.value$="Info""> <set token="tkn_search">SET_YOUR_SEARCH $trellis.value$</set> </condition> <condition match="$trellis.value$="Warn""> <set token="tkn_search">SET_YOUR_SEARCH $trellis.value$ </set> </condition> </drilldown> </single> <html> $tkn_search$ </html> <html depends="$alwaysHideCSS$"> <style> #singleTrellis1 #facet-viz_groupby_field_lvl_groupby_value_Error svg{ background-color: aqua; } #singleTrellis1 #facet-viz_groupby_field_lvl_groupby_value_Info svg{ background-color: green; } #singleTrellis1 #facet-viz_groupby_field_lvl_groupby_value_Warn svg{ background-color: yellow; } #singleTrellis1 #facet-viz_data_source_Error svg{ background-color: aqua; } #singleTrellis1 #facet-viz_data_source_Info svg{ background-color: green; } #singleTrellis1 #facet-viz_data_source_Warn svg{ background-color: yellow; } </style> </html> </panel> </row> </dashboard>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Adding drilldown to trellis layout

ritupatil02 — Mon, 21 Jun 2021 07:23:57 GMT

Won't a condition be required ?

If I have to go to different search when I click on Error and Info

Re: Adding drilldown to trellis layout

kamlesh_vaghela — Mon, 21 Jun 2021 07:39:31 GMT

@ritupatil02

I have updated my answer. Please check drill down logic and set search as per your requirement.

Re: Adding drilldown to trellis layout

ritupatil02 — Wed, 23 Jun 2021 11:25:33 GMT

@kamlesh_vaghela

I did set the search in the drilldown but its still taking me too the originally set query

Re: Adding drilldown to trellis layout

kamlesh_vaghela — Thu, 24 Jun 2021 04:32:14 GMT

@ritupatil02

Can you please share your sample SingleView XML?

Re: Adding drilldown to trellis layout

ritupatil02 — Thu, 24 Jun 2021 09:52:07 GMT

@kamlesh_vaghela

<search>
<query>$envInput$ sourcetype="meridium:webapi" appn="APM - Meridium"
| stats count by lvl
| eventstats sum(count) as total

| eval count=100*count/total
| fields - total
| transpose header_field=lvl column_name=lvl
| fields - lvl</query>
<earliest>$timeInput.earliest$</earliest>
<latest>$timeInput.latest$</latest>
</search>
<option name="drilldown">all</option>
<option name="height">130</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="unit">%</option>
<option name="colorMode">none</option>
<drilldown>
<condition match="$trellis.value$="Error"">
<set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" $trellis.value$</set>
</condition>
<condition match="$trellis.value$="Info"">
<set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$</set>
</condition>
<condition match="$trellis.value$="Warn"">
<set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$ </set>
</condition>
</drilldown>

</single>
<html>
$tkn_search$
</html>
<html depends="$alwaysHideCSS$">
<style>
#test40 #facet-viz_data_source_Error svg{
background-color: crimson;
}
#test40 #facet-viz_data_source_Info svg{
background-color: forestgreen;
}
#test40 #facet-viz_data_source_Warn svg{
background-color: darkorange;
}
</style>
</html>

Also, the search is not opening in a new window

Re: Adding drilldown to trellis layout

kamlesh_vaghela — Thu, 24 Jun 2021 10:31:56 GMT

@ritupatil02

Drilldown condition works fine in local. Can you please update same with below code and check search token?

<condition match="$trellis.value$="Error""> <set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" $trellis.value$</set> </condition> <condition match="$trellis.value$="Info""> <set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$</set> </condition> <condition match="$trellis.value$="Warn""> <set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$ </set> </condition> <condition> <set token="tkn_search">$trellis.value$ </set> </condition>

I've added extra condition for debug purpose. Just check tkn_search value on drill down.

If you want to open the search in new window then try this.

<condition match="$trellis.value$="Error""> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" $trellis.value$</link> </condition> <condition match="$trellis.value$="Info""> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$</link> </condition> <condition match="$trellis.value$="Warn""> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$</link> </condition> <condition> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="*" sourcetype="meridium:webapi" $trellis.value$</link> </condition>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Adding drilldown to trellis layout

ritupatil02 — Thu, 24 Jun 2021 11:00:13 GMT

@kamlesh_vaghela

Why does the drilldown returns this query "(host="prod*") appn="APM - Meridium" rslt="*" sourcetype="meridium:webapi" $trellis.value$" when it should actually return "(host="prod*") appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi""

Re: Adding drilldown to trellis layout

kamlesh_vaghela — Thu, 24 Jun 2021 11:20:14 GMT

@ritupatil02

You have used transpose command and then after fields - lvl. So may me due to that you unable to find $trellis.value$ during drilldown. That's Y I suggested stats command in my example.

But you can use the same search with below drilldown condition. Here direct field name is used in condition.

<condition match="$row.Error$>"-1""> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" Error</link> </condition> <condition match="$row.Info$>"-1""> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" Info</link> </condition> <condition match="$row.Warn$>"-1""> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" Warn</link> </condition>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Adding drilldown to trellis layout

ritupatil02 — Thu, 24 Jun 2021 11:37:45 GMT

@kamlesh_vaghela

That worked absolutely fine.. Thanks!! 🙂

Can we also add shared time range picker to the drilldown search?

Re: Adding drilldown to trellis layout

kamlesh_vaghela — Thu, 24 Jun 2021 12:22:42 GMT

Yes @ritupatil02

Just append below code link.

&earliest=$timeInput.earliest$&latest=$timeInput.latest$

<condition match="$row.Error$>"-1""> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" Error&earliest=$timeInput.earliest$&latest=$timeInput.latest$</link> </condition> <condition match="$row.Info$>"-1""> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" Info&earliest=$timeInput.earliest$&latest=$timeInput.latest$</link> </condition> <condition match="$row.Warn$>"-1""> <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" Warn&earliest=$timeInput.earliest$&latest=$timeInput.latest$</link> </condition>

Re: Adding drilldown to trellis layout

ritupatil02 — Thu, 24 Jun 2021 11:52:50 GMT

@kamlesh_vaghela

Gives "Invalid character entity" error

Re: Adding drilldown to trellis layout

kamlesh_vaghela — Thu, 24 Jun 2021 12:23:08 GMT

I have encode & to &

Check my updated answer.