For a single in-page drilldown, the following codes work as expected from "master1" table. How can I set up an in-page drilldown from either either token from "master1" or "master2"?
<form>
<label>Process Tracking</label>
<fieldset submitButton="false">
<input type="dropdown" token="p_usage" searchWhenChanged="true">
<label>Usage</label>
<search>
<query>| inputlookup usage.csv</query>
<earliest>0</earliest>
</search>
<fieldForLabel>range</fieldForLabel>
<fieldForValue>range</fieldForValue>
<initialValue>usage<1%</initialValue>
<default>usage<1%</default>
</input>
<input type="time" token="p_time" searchWhenChanged="true">
<label>Time Range</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table id="master1">
<title>Total process</title>
<search>
<query>index=xxxxxx sourcetype="xxxxxxxx" range="$p_usage$" | stats dc(host) AS count by process | sort - count</query>
<earliest>$p_time.earliest$</earliest>
<latest>$p_time.latest$</latest>
</search>
<option name="drilldown">row</option>
<drilldown>
<set token="tk_process">$row.process$</set>
</drilldown>
</table>
</panel>
<panel>
<table id="master2">
<title>Total Workstation</title>
<search>
<query>index=xxxxxx sourcetype="xxxxxxxx" range="$p_usage$" | stats dc(process) AS count by host | sort - count</query>
<earliest>$p_time.earliest$</earliest>
<latest>$p_time.latest$</latest>
</search>
<option name="drilldown">row</option>
<drilldown>
<set token="tk_host">$row.host$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<table id="detail" depends="$tk_process$">
<title>Detail: $tk_process$</title>
<search>
<query>index=xxxxxx sourcetype="xxxxxxxx" process="$tk_process$" | dedup host process | table host process</query>
<earliest>$p_time.earliest$</earliest>
<latest>$p_time.latest$</latest>
</search>
</table>
</row>
</form>
Use the same token name in the drilldown stanza (instead of using tk_process and tk_host, just use tk_drilldown in both places). Remember to update the depends=
and panel 3 query with new token name.
Use the same token name in the drilldown stanza (instead of using tk_process and tk_host, just use tk_drilldown in both places). Remember to update the depends=
and panel 3 query with new token name.
Thanks. That works.