topic Re: Drilldown not working properly in Dashboards & Visualizations

Why is drilldown not working properly?

aditsss — Thu, 23 Jun 2022 21:01:39 GMT

Hi Team,

I have two panels . For my 1st panel the query is:

<title>DataGraphNodes Exceptions Details</title>
<table>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="*" |rex field=_raw "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|stats count by ns app_name node nodeMethodName nodeException datetime |rename node as "Node"| rename nodeMethodName as "NodeMethod"|rename nodeException as "Node-Exception" | rename datetime as "Log_Time"|fields - count</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</table>

And I am getting result like this:

ns app-name Node Node method Exception Log-Time

sidh-datagraph3 data-graph-acct-b https getDetailsBySENo Invalid Id 2022-06-21

sidh2 data-acct-b https invalid InvalidId 2022-06-22

Foe 2nd panel I want when I click on 1st panel row the details should come based on the row I will select on 1st panel.

My 2nd panel query is:

<panel depends="$show_panel$">
<table>
<title> Events</title>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException $node$ $selected_value$ </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
</table>
</panel>

But its not coming proper in 2nd panel all the results are coming. I want only the row that I select in 1st panel that exception will come.

Can someone guide me.

Re: Drilldown not working properly

gcusello — Thu, 23 Jun 2022 13:18:38 GMT

Hi @aditsss,

you should see in the splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603/) there's an example that exactly answers to your need: "In-page Drilldown with Perma-Linking".

Anyway, the problem is that with click.value you tale only one value, instead you have to take more values, so, use the $row.<field>$ option to set values:

<set token="node">$row.node$</set> <set token="selected_value">$row.selected_value$</set>

Ciao.

Giuseppe

Re: Drilldown not working properly

aditsss — Thu, 23 Jun 2022 13:32:37 GMT

@gcusello

I made the below changes in 1st panel dashboard

<title>DataGraphNodes Exceptions Details</title>
<table>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="*" |rex field=_raw "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|stats count by ns app_name node nodeMethodName nodeException datetime |rename node as "Node"| rename nodeMethodName as "NodeMethod"|rename nodeException as "Node-Exception" | rename datetime as "Log_Time"|fields - count</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<drilldown>
<set token="show_panel">true</set>
<set token="node">$row.node$</set>
<set token="selected_value">$row.selected_value$</set>
</drilldown>
</table>
</panel>

NO RESULT FOUND IS COMING IN 2ND DASHBORAD

Re: Drilldown not working properly

gcusello — Thu, 23 Jun 2022 14:06:30 GMT

Hi @aditsss,

what's the search in panle2?

you should try:

index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="$node$" selected_value="$selected_value$"

then check if the fields in panel2 are correct and if the values from Panel1 match some value in panel 2.

Ciao.

Giuseppe

Re: Drilldown not working properly

aditsss — Thu, 23 Jun 2022 14:55:58 GMT

@gcusello

The data is still not coming in 2nd panel

My 1st panel query

<panel>
<title>DataGraphNodes Exceptions Details</title>
<table>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="*" |rex field=_raw "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|stats count by ns app_name node nodeMethodName nodeException datetime |rename node as "Node"| rename nodeMethodName as "NodeMethod"|rename nodeException as "Node-Exception" | rename datetime as "Log_Time"|fields - count</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<drilldown>
<set token="show_panel">true</set>t>
<set token="selected_value">$row.selected_value$</set>
</drilldown>
</table>
</panel>

My 2nd panel query

<panel depends="$show_panel$">
<table>
<title> Events</title>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="*" selected_value="$selected_value$" </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
</table>
</panel>

Re: Drilldown not working properly

gcusello — Fri, 24 Jun 2022 06:37:18 GMT

Hi @aditsss,

as I said:

first check:

what are the fields to pass as tokens from the first and the second panel?
Are you sure that they have the same field name?

second check:

what's an example of values of the first panel that matches in the second panel?
you should manually test this.

Ciao.

Giuseppe