All Apps and Add-ons
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

Single drilldown from multiple charts

MatMeredith
Path Finder
‎06-28-2013 01:53 AM

I have a dashboard which contains three charts all of which present different views of the same data. I'd like to set up my dashboard so that when the user clicks on a data point in one of the three charts, a fourth drilldown chart is rendered at the bottom of the page. I want to perform the same drilldown action irrespective of which of the three charts is clicked on.

I'm using Sideview Utils. Is this possible?

At the moment, I've configured the same drilldown logic in each of my three charts. This means that the code is repeated, and the drilldown chart opens beneath whichever chart the user clicks on. I'd rather avoid the code repetition, and also always have the drilldown chart open at the bottom of the page.

Reply
1 Solution
Solved! Jump to solution
Solution

sideview
SplunkTrust
SplunkTrust
‎06-28-2013 10:00 AM

You've found one of the core use cases of the Gate module. The Gate module has been released for a while, but quietly, in that it is still undocumented. Sideview has used Gate in some of its apps but that's about it.

Essentially, nested just downstream from each of your three charts, you put this one module: 

<module name="Gate">
  <param name="to">myCommonDrilldown</param>
</module>

and then upstream from what will be your shared drilldown table, you put this: 

<module name="Gate">
  <param name="id">myCommonDrilldown</param>
  ...

Gate has one other major use case, and although it's not related to your needs here I will mention it as quickly - Gate can prevent a push from proceeding downstream until some key or keys are set. So for example if you have two or more Pulldowns, you don't want to put a Button next to them, and you want the main search on the page to only run when all of the Pulldowns are set, you would use a Gate there. Again, this other feature of Gate has nothing to do with your use case.

If you don't mind using a Sideview module that is not fully documented, go ahead. there is basic param reference documentation that you can see by going to /en-US/modules in SplunkWeb. the next release of Sideview Utils (2.5) will be out in a few days and the Gate module will be final and will also have official docs-and-examples pages in Sideview Utils. If you get the latest (2.4.10), it's in there, but it's still has a prototype status.

Remember this is all only in the latest Sideview Utils, available for free but only available from the Sideview site - http://sideviewapps.com/apps/sideview-utils . Not many companies are still on the old version, but there are still some strange holdouts out there.

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

sideview
SplunkTrust
SplunkTrust
‎06-28-2013 10:00 AM

You've found one of the core use cases of the Gate module. The Gate module has been released for a while, but quietly, in that it is still undocumented. Sideview has used Gate in some of its apps but that's about it.

Essentially, nested just downstream from each of your three charts, you put this one module: 

<module name="Gate">
  <param name="to">myCommonDrilldown</param>
</module>

and then upstream from what will be your shared drilldown table, you put this: 

<module name="Gate">
  <param name="id">myCommonDrilldown</param>
  ...

Gate has one other major use case, and although it's not related to your needs here I will mention it as quickly - Gate can prevent a push from proceeding downstream until some key or keys are set. So for example if you have two or more Pulldowns, you don't want to put a Button next to them, and you want the main search on the page to only run when all of the Pulldowns are set, you would use a Gate there. Again, this other feature of Gate has nothing to do with your use case.

If you don't mind using a Sideview module that is not fully documented, go ahead. there is basic param reference documentation that you can see by going to /en-US/modules in SplunkWeb. the next release of Sideview Utils (2.5) will be out in a few days and the Gate module will be final and will also have official docs-and-examples pages in Sideview Utils. If you get the latest (2.4.10), it's in there, but it's still has a prototype status.

Remember this is all only in the latest Sideview Utils, available for free but only available from the Sideview site - http://sideviewapps.com/apps/sideview-utils . Not many companies are still on the old version, but there are still some strange holdouts out there.

0 Karma
Reply
Solved! Jump to solution

sideview
SplunkTrust
SplunkTrust
‎07-05-2013 11:25 AM

Sideview Utils 2.5 is now out, the Gate module does now have official documentation, and indeed there were substantial bugfixes in Gate between 2.4.10 and 2.5. So if you downloaded 2.4.10 and have been using the Gate module, I recommend updating to 2.5. Cheers.

0 Karma
Reply
Solved! Jump to solution

anjneesharma
New Member
‎06-29-2018 11:36 AM 
Even i have same question to ask but i could not understand from above solution i am pasting my problem bellow.

    <panel>
          <title>New CRs</title>
          <html class="html">
                    <div class="help-tip">  
                    <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
                    </div>
                </html>
          <single>
            <search>
              <query>|`macro_ChangeRequest_JIRA`|search "CR State"="*"|table _time "Request item" "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
              <earliest>-48h</earliest>
              <latest>now</latest>
            </search>
            <option name="colorBy">value</option>
            <option name="colorMode">none</option>
            <option name="drilldown">all</option>
            <option name="height">80</option>
            <option name="linkView">search</option>
            <option name="numberPrecision">0</option>
            <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
            <option name="rangeValues">[0]</option>
            <option name="showSparkline">1</option>
            <option name="showTrendIndicator">1</option>
            <option name="trendColorInterpretation">standard</option>
            <option name="trendDisplayMode">absolute</option>
            <option name="underLabel">New CRs</option>
            <option name="unitPosition">before</option>
            <option name="useColors">1</option>
            <option name="useThousandSeparators">1</option>
            <option name="link.visible">0</option>
            <drilldown target="_self">
              <set token="NewCR_tok">$click.value$</set>
              <unset token="Opencr_tok"></unset>
              <unset token="OpenCR_tok"></unset>
              <unset token="OnHoldCR_tok"></unset>
            </drilldown>
          </single>
        </panel>

Drill down

<row>
    <panel depends="$NewCR_tok$">
      <input type="checkbox" token="tokReset1" searchWhenChanged="true">
        <label></label>
        <change>
          <unset token="NewCR_tok"></unset>
          <unset token="form.tokReset1"></unset>
        </change>
        <choice value="hide">Hide Details</choice>
        <delimiter> </delimiter>
      </input>
      <table>
        <title>New CRs details</title>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" reated "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"="*"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
          <earliest>-48h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">0</option>
      </table>
    </panel>
    </raw>

second columen


<panel>
      <title>Open CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the number of Open CRs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Complete" "CR State"!="On Hold"|table _time "Request item" "CR State" "JIRA #" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Open CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown target="_self">
          <set token="OpenCR_tok">$click.value$</set>
          <unset token="Opencr_tok"></unset>
          <unset token="NewCR_tok"></unset>
          <unset token="OnHoldCR_tok"></unset>
        </drilldown>
      </single>
    </panel>


Drill down


<row>
    <panel depends="$OpenCR_tok$">
      <input type="checkbox" token="tokReset2" searchWhenChanged="true">
        <label></label>
        <change>
          <unset token="OpenCR_tok"></unset>
          <unset token="form.tokReset2"></unset>
        </change>
        <choice value="hide">Hide Details</choice>
        <delimiter> </delimiter>
      </input>
      <table>
        <title>Open CRs details</title>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" Created "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"!="Closed Skipped" "CR State"!="Closed Incomplete" "CR State"!="Closed Complete" "CR State"!="On Hold" "CR State"!="Closed Incomplete (Cancelled)""CR State"!="Closed Skipped (Rejected)"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">0</option>
      </table>
    </panel>
  </row>

like this i have 5 single value chart and 5 drill down table how can i combine in single table could you please explain me with example.

0 Karma
Reply
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...