Limitation of $click.value$ drilldown in "3D Graph...

luispulido

In a Splunk dashboard, I’m using the custom visualization "3D Graph Network Topology Viz".
The goal is that when clicking on a node, a token is set so another panel can display related details.

The issue is:

When configuring On Click → Manage tokens on this dashboard, Splunk shows the message:
"This custom visualization might not support drilldown behavior."
When clicking on a node, the $click.value$ token does not update and literally remains as $click.value$, which confirms that it’s not sending dynamic values.
The only token that actually receives data is $click.name$, which returns the node’s name, but not other values I’d like to capture.

Has anyone successfully implemented full drilldown support in this visualization or knows how to extend it so that more tokens (like $click.value$) can be populated when clicking on a node?

bowesmana

Use $row.src$ instead of $click.value$.

You can see that $row.src$ is set, as well as click.name and click.name2

The documentation in the details tab does talk about using $row.xxx$

https://splunkbase.splunk.com/app/4611

<dashboard version="1.1" theme="light">
  <label>3dGraph</label>
  <row>
    <panel>
      <viz type="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz">
        <search base="base">
          <query/>
        </search>
        <option name="drilldown">all</option>
        <option name="height">650</option>
        <option name="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz.bgColor">#000011</option>
        <option name="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz.cameraController">trackball</option>
        <option name="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz.dagMode">null</option>
        <option name="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz.enable3D">0</option>
        <option name="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz.lkColor">#ffffff</option>
        <option name="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz.ndColor">#EDCBB1</option>
        <option name="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz.showAnimationBar">0</option>
        <option name="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz.showLinkArrows">0</option>
        <option name="splunk-3D-graph-network-topology-viz.3d_graph_network_topology_viz.showNodeLabels">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="click_dest">$row.dest$</set>
          <set token="click_src">$row.src$</set>
          <set token="click_CV">$click.value$</set>
          <set token="click_CN">$click.name$</set>
          <set token="click_CV2">$click.value2$</set>
          <set token="click_CN2">$click.name2$</set>
        </drilldown>
      </viz>
    </panel>
    <panel>
      <html>
        <h1>Tokens</h1>
        <ul>
          <li>src=$click_src$</li>
          <li>Dest = $click_dest$</li>
          <li>CV = $click_CV$</li>
          <li>CN = $click_CN$</li>
          <li>CV2 = $click_CV2$</li>
          <li>CN2 = $click_CN2$</li>
        </ul>
      </html>
      <table>
        <search id="base">
          <query>| makeresults count=100
| eval nodes=split("ABCDDEFGHIJ","")
| eval src=mvindex(nodes, random() % mvcount(nodes))
| eval dest=mvindex(mvmap(nodes, if(nodes=src, null(), nodes)), random() % (mvcount(nodes) - 1))
| stats count by src dest
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

tej57

Hey @luispulido,

As the warning suggests, it is possible that Drilldown might not function properly for Dashboard Studio. However, upon checking Splunkbase, it seems it can work well with Classic Dashboard.

If you can switch your dashboard back to Classic, I suppose you'll be able to have fully functional visualization. And you can then utilize the tokens as per the use case as well.

Thanks,
Tejas.

---
If the above solution helps, an upvote is appreciated..!!

luispulido

Hello @tej57 ,

Thanks for your response.

I can confirm that my dashboard is already built in Classic Dashboard, not Dashboard Studio.
However, even in Classic mode, the $click.value$ token is not being populated when clicking a node. The only token that works is $click.name$.

PrewinThomas

@luispulido

You can use row.<fieldname> or click.value in classic. Below example you can use row.user or click.value both works.

<dashboard version="1.1">
  <label>Click Value</label>
  <description>Demo dashboard: Click a value from the first panel to display it in the second panel using tokens.</description>
  <!-- Row 1: Table with clickable values -->
  <!-- Row 2: Panel showing clicked value -->
  <row>
    <panel>
      <title>User List (Click a row)</title>
      <table>
        <search>
          <query>
            | makeresults count=5
| streamstats count as row
| eval user=case(
    row=1, "alice",
    row=2, "bob",
    row=3, "charlie",
    row=4, "dave",
    row=5, "eve"
  )
| table user

          </query>
        </search>
        <drilldown>
          <!-- Set the clicked_user token based on clicked row -->
          <set token="clicked_user">$row.user$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Clicked Value</title>
      <single>
        <search>
          <query>
            | makeresults 
            | eval message="You clicked on: $clicked_user$" 
            | table message
          </query>
        </search>
      </single>
    </panel>
  </row>
</dashboard>

Also for dashboard studio, you can follow below
Ref
#https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Parse-value-from-one-panel-to-anoth...

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

bowesmana

Maybe you missed the point in his posting that click.value does NOT work with that visualisation...

Limitation of $click.value$ drilldown in "3D Graph Network Topology Viz" visualization

dashboard

Can’t make it to .conf25? Join us online!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Unlock What’s Next: The Splunk Cloud Platform at .conf25

Are you a member of the Splunk Community?