topic Re: Drill down using multiple conditions in Splunk Search

Drill down using multiple conditions

kallisrayar1986 — Sat, 17 Jan 2015 00:53:01 GMT

I have a pie chart with multiple slices, clicking on each slice will take you to Custom URL, please see the simple xml below:
Unfortunately it takes me to the same URL which is at the top,again and again. I even tried keeping this condition in one drilldown but still it did not work. Please help..

      <condition value="Media Content (Bytes)">
        <link>URL1</link>
        </condition>          
    </drilldown> 
    <drilldown>
      <condition value="Text Content (Bytes)">
             <link>URL2</link>    
       </condition>
    </drilldown>

Re: Drill down using multiple conditions

martin_mueller — Sat, 17 Jan 2015 22:54:58 GMT

That's not going to work, the value attribute is only valid in the input context of the condition element, not in the drilldown context: http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/PanelreferenceforSimplifiedXML#condition_.28drilldown.29

The only thing you can condition on here is the field name that was clicked, which in a pie is always the same field.

A possible workaround would be to have a small script on some web server that gets passed the clicked value in a parameter and then redirects to the appropriate URL.
Another possibility would be to add a custom JS event handler that suppresses the default drilldown and instead does its own logic.

Re: Drill down using multiple conditions

kallisrayar1986 — Tue, 20 Jan 2015 21:46:25 GMT

Could you please share some samples for Custome JS event for this scenario, if any?

Re: Drill down using multiple conditions

martin_mueller — Tue, 20 Jan 2015 22:00:47 GMT

There are plenty of custom JS examples here: https://apps.splunk.com/app/1603/ Not sure if they go far enough though.