Splunk DB Connect 1: How to create a drilldown link on a dashboard to a dbquery to show items within the clicked category?

[bcapuyan]

Hello,

I have a dashboard with categories and a count of each item in each category. I would like to click the category and create a drill down link to a DB Connect query that shows each item within that category rather than the category name and count of each item.

(e.g. XML Source see attached image)

I get the error:

Invalid view name requested: "| dbquery mon02 "SELECT * from usertasks"". View names may only contain alphanumeric characters.

I cannot get the proper syntax down when querying with DB Connect.

Any ideas?

Thanks in advance

[felipesewaybric]

Using simple XML, set tokens with the drilldown, and than open a new table or graphic with the new search using the query with the token:

Like this

<row>
<panel>
<chart>
<search>
<query>
index=main | table Offer Price
</query>
</search>
<drilldown>
<set token="offer_token">$click.value$</set>
</drilldown>
</chart>

<table depends="$offer_token$">
<search>
<query>
| dbquery mon02 "select * from table where COD_OFFER=$offer_token$" | table id offer etc
</query>
</search>
</table>
</panel>
</row>

The DEPENDS is only to hide your table when the token $offer_token$ is null.

[jplumsdaine22]

You can't just put a raw query in the link tag. You need to put in a path. Have a look at the documentation and examples here: http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/Dynamicdrilldownindashboardsandforms

Try copying the url you see when you run an actual search in the UI.

And for the token values you can use for your drill down see this section: http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/tokens#Define_tokens_for_dynamic_drilldown