topic Re: How to create a drilldown in Splunk Search

How to create a drilldown

jsuryaprakash — Wed, 04 Sep 2019 19:50:54 GMT

Hello everyone,
I am trying to create a simple hiding drill down panel.
With below search:

index=_internal |stats dc(user) as uniqueusers by sourcetype host

Which gives below table:

sourcetype host uniqueusers
aaaa ccc 4
bbbbb ddddd 2

When a user clicks on uniquesusers value for example 4 it should show a new panel below with list of 4 uniqueuser names.

Re: How to create a drilldown

jsuryaprakash — Wed, 04 Sep 2019 19:57:13 GMT

below is the query i achieved so far. i am unable to parse the token value

DrillDown

<panel>
  <table>
    <search>
      <query>index=_*|stats dc(user) as user  by sourcetype host source</query>
      <earliest>-15m</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <set token="show_panel">true</set>
      <set token="selected_value">$click.value2$</set>
    </drilldown>
  </table>
</panel>


<panel depends="$selected_value$">
  <table>
    <search>
      <query>index=_* |stats values(user) as user  by sourcetype host source | mvexpand user| search user=$selected_value$ </query>
      <earliest>-15m</earliest>
      <latest>now</latest>
    </search>
    <option name="count">20</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">none</option>
    <option name="percentagesRow">false</option>
    <option name="refresh.display">progressbar</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
  </table>
</panel>

Re: How to create a drilldown

jsuryaprakash — Wed, 04 Sep 2019 19:57:58 GMT

when i click on user count for example its taking user=4 . I want the value values instead of number.

Re: How to create a drilldown

mayurr98 — Wed, 04 Sep 2019 21:51:25 GMT

Try this :

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_*|stats dc(user) as user  by sourcetype host source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <set token="show_panel">true</set>
          <set token="user">$click.value2$</set>
          <set token="source">$row.source$</set>
          <set token="host">$row.host$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$user$">
      <table>
        <search>
          <query>index=_* |stats values(user) as user dc(user) as user_count  by sourcetype host source | search user_count=$user$ source="$source$" host=$host$ | mvexpand user</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

Re: How to create a drilldown

jsuryaprakash — Thu, 05 Sep 2019 03:14:25 GMT

It’s only working for the first value of the user column.
For other values in that column it’s showing no data. Can you please look into it.

Re: How to create a drilldown

mayurr98 — Thu, 05 Sep 2019 15:04:31 GMT

It's working for me for each value of the user column. create a new dashboard and copy-paste entire XML.