topic Re: help on drillwonwn from a table with time in Splunk Search

How to create drilldown from a table with time in order to display more details?

jip31 — Wed, 23 Mar 2022 22:04:20 GMT

hello

As you can see, I use a table with one hour bin span and I need to drillwown on every row in order to display more details in another dashboard

how to do this please?

Re: help on drillwonwn from a table with time

ITWhisperer — Wed, 23 Mar 2022 15:39:20 GMT

Enable drilldown for cells in the dashboard table definition. In the drilldown, you could link to another dashboard passing the references to the column and row. Alternatively, you could set tokens for these values and use them in a search for another panel within the same dashboard.

Re: help on drillwonwn from a table with time

jip31 — Wed, 23 Mar 2022 16:52:51 GMT

Thanks

I have done this and it works fine

But the problem is that I need

<drilldown>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
</drilldown>
<drilldown>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
</drilldown>

The message is Expected at most 1 children of drilldown in table, instead saw 2

So I cant do this more than 1 time?

Is there e trick for changing this please?

Re: help on drillwonwn from a table with time

ITWhisperer — Wed, 23 Mar 2022 17:29:02 GMT

If you want to open two (or more) tabs from one click, do it this way

<drilldown> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link> </drilldown>

Re: help on drillwonwn from a table with time

jip31 — Thu, 24 Mar 2022 06:06:14 GMT

No I dont want to open 2 or many tabs on one click

KPI is the colum_name of a transpose command

| transpose 0 header_field=time column_name=KPI

So in this colum, there is many different fields

So what I need is to be able to click on this field and to open the dashboard corresponding

I tried something like this

<drilldown> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$"AB"$</link> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$"CD"$</link> </drilldown>

It works because it open the dashboard but not the good

It eans thateven if I click on "AB" OR on "CD", its just the dash "heatmap_dash" which opens and not "heatmap_dash2"

Have you another idea please?

Re: help on drillwonwn from a table with time

ITWhisperer — Thu, 24 Mar 2022 06:27:56 GMT

Does something like this work?

<drilldown> <condition match="'click.name2'=="AB""> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link> </condition> <condition match="'click.name2'=="CD""> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link> </condition> </drilldown>

Re: help on drillwonwn from a table with time

jip31 — Thu, 24 Mar 2022 06:54:40 GMT

Unfortunately not

I have repalce "AB" and "CD" with the good field name like below but when I click on the field it just open a new search

<drilldown> <condition match="'click.name2'=="CAP CLIENT - Nb d'erreurs""> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link> </condition> <condition match="'click.name2'=="CAP CLIENT - Nb d'utilisateurs ayant un temps de réponse > 7 sec""> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link> </condition>

Re: help on drillwonwn from a table with time

ITWhisperer — Thu, 24 Mar 2022 06:57:55 GMT

is "CAP CLIENT - Nb d'erreurs" the name of a column or the value in the first column?

Re: help on drillwonwn from a table with time

jip31 — Thu, 24 Mar 2022 07:14:01 GMT

it's one of the value of the KPI column

Re: help on drillwonwn from a table with time

ITWhisperer — Thu, 24 Mar 2022 07:54:19 GMT

Try it with click.value instead

<drilldown> <condition match="'click.value'=="CAP CLIENT - Nb d'erreurs""> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link> </condition> <condition match="'click.value'=="CAP CLIENT - Nb d'utilisateurs ayant un temps de réponse > 7 sec""> <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link> </condition>

Re: help on drillwonwn from a table with time

jip31 — Thu, 24 Mar 2022 08:26:27 GMT

it's perfect

thanks for your precious help