All Apps and Add-ons

Treemap: How to open a search using drilldown when clicked/zoomed on parent rectangle?

sohaibomar
Explorer

I was able to open a search using drilldown when clicked on child rectangle of tree maps as mentioned in official documentation here
http://docs.splunk.com/Documentation/Treemap/1.1.1/TreemapViz/TreeMapComponents

But I need to open a search when parent category is Zoomed/Clicked, so far I have tried below code but it doesn't pass the token until clicked on children rectangle.

<form>
  <label>treemaps drilldown</label>
    <row>
    <panel>
      <title>treemap</title>
      <viz type="treemap_app.treemap">
        <search>
          <query>sourcetype="syslog"| stats sum(traffic) by category, application</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="drilldown">all</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="category">$row.category$</set>
        </drilldown>

      </viz>
    </panel>
    <panel depends="$category$">
      <chart>
        <title>Top Applications of Category $category$ </title>
        <search>
          <query>sourcetype="syslog" category=$category$| top application</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

Is it possible to use drilldown when clicked on parent rectangle in treemaps?

cmerriman
Super Champion

Unfortunately, Treemap doesn't support drilldowns until you reach the child level. Generally it would open in search, unless you defined a drilldown behavior. From looking at your code, it should be picking up the parent category and using that in your second search. I understand it is more of an inconvenience to the users, but I don't think there is a way around it unless you were to customize the treemap code itself.

sohaibomar
Explorer

Yeah, seems legit.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...