All Apps and Add-ons

Treemap: How to open a search using drilldown when clicked/zoomed on parent rectangle?

sohaibomar
Explorer

I was able to open a search using drilldown when clicked on child rectangle of tree maps as mentioned in official documentation here
http://docs.splunk.com/Documentation/Treemap/1.1.1/TreemapViz/TreeMapComponents

But I need to open a search when parent category is Zoomed/Clicked, so far I have tried below code but it doesn't pass the token until clicked on children rectangle.

<form>
  <label>treemaps drilldown</label>
    <row>
    <panel>
      <title>treemap</title>
      <viz type="treemap_app.treemap">
        <search>
          <query>sourcetype="syslog"| stats sum(traffic) by category, application</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="drilldown">all</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="category">$row.category$</set>
        </drilldown>

      </viz>
    </panel>
    <panel depends="$category$">
      <chart>
        <title>Top Applications of Category $category$ </title>
        <search>
          <query>sourcetype="syslog" category=$category$| top application</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

Is it possible to use drilldown when clicked on parent rectangle in treemaps?

cmerriman
Super Champion

Unfortunately, Treemap doesn't support drilldowns until you reach the child level. Generally it would open in search, unless you defined a drilldown behavior. From looking at your code, it should be picking up the parent category and using that in your second search. I understand it is more of an inconvenience to the users, but I don't think there is a way around it unless you were to customize the treemap code itself.

sohaibomar
Explorer

Yeah, seems legit.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...