How to create a drill down from one panel to another? I don't have any data for example but any scenario for explanation would be really appreciated.
Hello
Please take this example code I created (it is generic so just copy and paste to your instance).
You have a pi-chart in the top and when you click a row, it assigns a token "src" that is used below for showing a table of count agains time to that corresponding drilled down value:
<dashboard>
<label>DrillDownPanelToAnother</label>
<row>
<panel>
<chart>
<search>
<query>| tstats count where index=_internal by source</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="src">$click.value$</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>| tstats count where index=_internal AND source="$src$" by _time span=1h</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard>
Hello
Please take this example code I created (it is generic so just copy and paste to your instance).
You have a pi-chart in the top and when you click a row, it assigns a token "src" that is used below for showing a table of count agains time to that corresponding drilled down value:
<dashboard>
<label>DrillDownPanelToAnother</label>
<row>
<panel>
<chart>
<search>
<query>| tstats count where index=_internal by source</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="src">$click.value$</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>| tstats count where index=_internal AND source="$src$" by _time span=1h</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard>
@tiagofbmm, I think you got the requirement reversed. Drilldown from Pie Chart to Table.
@abhi04, Refer to one of my recent answers for the same (you can refer to unaccepted answer which is closed to your request): https://answers.splunk.com/answers/625052/display-different-panel-depends-on-selected-name-i.html
Also refer to Splunk Dashboard Examples App which has several examples on Drilldown.
Thanks niketnilay and tiagofbmm.
@niketnilay thanks for noticing that. Edited and corrected