Alerting

Can you help me enable the trellis automatically in a dashboard drill down?

manic3773
Engager

I have a dashboard with a single figure. I have enabled drilldown to open a custom search.
The problem i'm having is enabling the trellis automatically. I've checked various docs but its not helping.

Can I drill down to a custom search and have the trellis view automatically enabled from a dashboard?

here is the code for the XML

<panel>
      <title>Netscaler Hits</title>
      <input type="time" token="field2">
        <label></label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <single>
        <search>
          <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">
          <option name="trellis.enabled">1</option>
          <option name="trellis.size">medium</option>
          <option name="trellis.scales.shared">0</option> 
            search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest</link>
        </drilldown>
      </single>
    </panel>
0 Karma
1 Solution

sdchakraborty
Contributor

Hi,

Can you try the below code,

<panel>
       <title>Netscaler Hits</title>
       <input type="time" token="field2">
         <label></label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
       <single>
         <search>
           <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
           <earliest>$field2.earliest$</earliest>
           <latest>$field2.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="drilldown">all</option>
         <option name="refresh.display">progressbar</option>
         <drilldown>
           <link target="_blank">
             /app/search/search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest&amp;display.page.search.mode=fast&amp;dispatch.sample_ratio=1&amp;display.general.type=visualizations&amp;display.page.search.tab=visualizations&amp;display.visualizations.trellis.enabled=1</link>
         </drilldown>
       </single>
     </panel>

View solution in original post

sdchakraborty
Contributor

Hi,

Can you try the below code,

<panel>
       <title>Netscaler Hits</title>
       <input type="time" token="field2">
         <label></label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
       <single>
         <search>
           <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
           <earliest>$field2.earliest$</earliest>
           <latest>$field2.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="drilldown">all</option>
         <option name="refresh.display">progressbar</option>
         <drilldown>
           <link target="_blank">
             /app/search/search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest&amp;display.page.search.mode=fast&amp;dispatch.sample_ratio=1&amp;display.general.type=visualizations&amp;display.page.search.tab=visualizations&amp;display.visualizations.trellis.enabled=1</link>
         </drilldown>
       </single>
     </panel>
Get Updates on the Splunk Community!

Index This | What gets bigger the more you remove?

June 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...