Alerting

Can you help me enable the trellis automatically in a dashboard drill down?

manic3773
Engager

I have a dashboard with a single figure. I have enabled drilldown to open a custom search.
The problem i'm having is enabling the trellis automatically. I've checked various docs but its not helping.

Can I drill down to a custom search and have the trellis view automatically enabled from a dashboard?

here is the code for the XML

<panel>
      <title>Netscaler Hits</title>
      <input type="time" token="field2">
        <label></label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <single>
        <search>
          <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">
          <option name="trellis.enabled">1</option>
          <option name="trellis.size">medium</option>
          <option name="trellis.scales.shared">0</option> 
            search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest</link>
        </drilldown>
      </single>
    </panel>
0 Karma
1 Solution

sdchakraborty
Contributor

Hi,

Can you try the below code,

<panel>
       <title>Netscaler Hits</title>
       <input type="time" token="field2">
         <label></label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
       <single>
         <search>
           <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
           <earliest>$field2.earliest$</earliest>
           <latest>$field2.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="drilldown">all</option>
         <option name="refresh.display">progressbar</option>
         <drilldown>
           <link target="_blank">
             /app/search/search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest&amp;display.page.search.mode=fast&amp;dispatch.sample_ratio=1&amp;display.general.type=visualizations&amp;display.page.search.tab=visualizations&amp;display.visualizations.trellis.enabled=1</link>
         </drilldown>
       </single>
     </panel>

View solution in original post

sdchakraborty
Contributor

Hi,

Can you try the below code,

<panel>
       <title>Netscaler Hits</title>
       <input type="time" token="field2">
         <label></label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
       <single>
         <search>
           <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
           <earliest>$field2.earliest$</earliest>
           <latest>$field2.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="drilldown">all</option>
         <option name="refresh.display">progressbar</option>
         <drilldown>
           <link target="_blank">
             /app/search/search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest&amp;display.page.search.mode=fast&amp;dispatch.sample_ratio=1&amp;display.general.type=visualizations&amp;display.page.search.tab=visualizations&amp;display.visualizations.trellis.enabled=1</link>
         </drilldown>
       </single>
     </panel>
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...