Solved: Adding drilldown to trellis layout

ritupatil02 · ‎06-17-2021

How to add drilldown to the split visualisation in trellis layout?

I tried using this but it didn't work out

<set token="selected_value">$trellis.value$</set>

</drilldown>

Is there any other way to achieve this?

Here's my XML:

<row>
<panel id="table1">
<title>Asset Hierarchy - ($name1$)</title>
<single id="test10">
<title>Percentage</title>

<search>
<query>$envInput$ sourcetype="meridium:assethierarchy" appn="APM - Meridium"
| stats count by lvl
| eventstats sum(count) as total
| eval count=100*count/total
| fields - total
| transpose header_field=lvl column_name=lvl
| fields - lvl</query>
<earliest>$timeInput.earliest$</earliest>
<latest>$timeInput.latest$</latest>
</search>
<option name="drilldown">all</option>
<option name="height">130</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0xdc4e41","0x53a051","0xf1813f","0x3c444d","0x3c444d"]</option>
<option name="trellis.enabled">1</option>
<option name="unit">%</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<link target="_blank">search?q=$envInput$%20sourcetype%3D%22meridium%3Aassethierarchy%22%20appn%3D%22APM%20-%20Meridium%22&earliest=$timeInput.earliest$&latest=$timeInput.latest$</link>
</drilldown>
</single>
</html>

kamlesh_vaghela · ‎06-18-2021

@ritupatil02

to have trelliss value you need to modify little bit your search. Please check below XML.

<dashboard>
  <label>Single View</label>
  <row>
    <panel>
      <single id="singleTrellis1">
        <search>
          <query>| makeresults count=10 | eval a=1 | accum a | eval lvl=case(a%3==0,"Error",a%3==1,"Info",a%3==2,"Warn") | stats count by lvl | eventstats sum(count) as total | eval count=(100*count/total). "%" | fields - total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$trellis.value$=&quot;Error&quot;">
            <set token="tkn_search">SET_YOUR_SEARCH $trellis.value$</set>  
          </condition>
          <condition match="$trellis.value$=&quot;Info&quot;">
            <set token="tkn_search">SET_YOUR_SEARCH $trellis.value$</set>  
          </condition>
          <condition match="$trellis.value$=&quot;Warn&quot;">
            <set token="tkn_search">SET_YOUR_SEARCH $trellis.value$ </set>  
          </condition>
        </drilldown>
      </single>
      <html>
        $tkn_search$
      </html>
      <html depends="$alwaysHideCSS$">
      <style>
        #singleTrellis1 #facet-viz_groupby_field_lvl_groupby_value_Error svg{
          background-color: aqua;
        }

        #singleTrellis1 #facet-viz_groupby_field_lvl_groupby_value_Info svg{
          background-color: green;
        }

        #singleTrellis1 #facet-viz_groupby_field_lvl_groupby_value_Warn svg{
          background-color: yellow;
        }
        #singleTrellis1 #facet-viz_data_source_Error svg{
          background-color: aqua;
        }
        #singleTrellis1 #facet-viz_data_source_Info svg{
          background-color: green;
        }
        #singleTrellis1 #facet-viz_data_source_Warn svg{
          background-color: yellow;
        }
      </style>
      </html>
    </panel>
  </row>
</dashboard>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela · ‎06-17-2021

@ritupatil02

Can you please check this?

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/VisualizationTrellis#Predefined_tokens_...

Please let me know if you face any difficulties.

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

ritupatil02 · ‎06-18-2021

Exactly where do we add "$trellis.value$" ?

kamlesh_vaghela · ‎06-18-2021

@ritupatil02

to have trelliss value you need to modify little bit your search. Please check below XML.

<dashboard>
  <label>Single View</label>
  <row>
    <panel>
      <single id="singleTrellis1">
        <search>
          <query>| makeresults count=10 | eval a=1 | accum a | eval lvl=case(a%3==0,"Error",a%3==1,"Info",a%3==2,"Warn") | stats count by lvl | eventstats sum(count) as total | eval count=(100*count/total). "%" | fields - total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$trellis.value$=&quot;Error&quot;">
            <set token="tkn_search">SET_YOUR_SEARCH $trellis.value$</set>  
          </condition>
          <condition match="$trellis.value$=&quot;Info&quot;">
            <set token="tkn_search">SET_YOUR_SEARCH $trellis.value$</set>  
          </condition>
          <condition match="$trellis.value$=&quot;Warn&quot;">
            <set token="tkn_search">SET_YOUR_SEARCH $trellis.value$ </set>  
          </condition>
        </drilldown>
      </single>
      <html>
        $tkn_search$
      </html>
      <html depends="$alwaysHideCSS$">
      <style>
        #singleTrellis1 #facet-viz_groupby_field_lvl_groupby_value_Error svg{
          background-color: aqua;
        }

        #singleTrellis1 #facet-viz_groupby_field_lvl_groupby_value_Info svg{
          background-color: green;
        }

        #singleTrellis1 #facet-viz_groupby_field_lvl_groupby_value_Warn svg{
          background-color: yellow;
        }
        #singleTrellis1 #facet-viz_data_source_Error svg{
          background-color: aqua;
        }
        #singleTrellis1 #facet-viz_data_source_Info svg{
          background-color: green;
        }
        #singleTrellis1 #facet-viz_data_source_Warn svg{
          background-color: yellow;
        }
      </style>
      </html>
    </panel>
  </row>
</dashboard>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

ritupatil02 · ‎06-21-2021

Won't a condition be required ?

If I have to go to different search when I click on Error and Info

kamlesh_vaghela · ‎06-21-2021

@ritupatil02

I have updated my answer. Please check drill down logic and set search as per your requirement.

ritupatil02 · ‎06-23-2021

@kamlesh_vaghela

I did set the search in the drilldown but its still taking me too the originally set query

kamlesh_vaghela · ‎06-23-2021

@ritupatil02

Can you please share your sample SingleView XML?

KV

ritupatil02 · ‎06-23-2021

@kamlesh_vaghela

<search>
<query>$envInput$ sourcetype="meridium:webapi" appn="APM - Meridium"
| stats count by lvl
| eventstats sum(count) as total

| eval count=100*count/total
| fields - total
| transpose header_field=lvl column_name=lvl
| fields - lvl</query>
<earliest>$timeInput.earliest$</earliest>
<latest>$timeInput.latest$</latest>
</search>
<option name="drilldown">all</option>
<option name="height">130</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="unit">%</option>
<option name="colorMode">none</option>
<drilldown>
<condition match="$trellis.value$="Error"">
<set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" $trellis.value$</set>
</condition>
<condition match="$trellis.value$="Info"">
<set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$</set>
</condition>
<condition match="$trellis.value$="Warn"">
<set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$ </set>
</condition>
</drilldown>

</single>
<html>
$tkn_search$
</html>
<html depends="$alwaysHideCSS$">
<style>
#test40 #facet-viz_data_source_Error svg{
background-color: crimson;
}
#test40 #facet-viz_data_source_Info svg{
background-color: forestgreen;
}
#test40 #facet-viz_data_source_Warn svg{
background-color: darkorange;
}
</style>
</html>

Also, the search is not opening in a new window

kamlesh_vaghela · ‎06-24-2021

@ritupatil02

Drilldown condition works fine in local. Can you please update same with below code and check search token?

<condition match="$trellis.value$=&quot;Error&quot;">
            <set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" $trellis.value$</set>
          </condition>
          <condition match="$trellis.value$=&quot;Info&quot;">
            <set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$</set>
          </condition>
          <condition match="$trellis.value$=&quot;Warn&quot;">
            <set token="tkn_search">$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$ </set>
          </condition>
          <condition>
            <set token="tkn_search">$trellis.value$ </set>
          </condition>

I've added extra condition for debug purpose. Just check tkn_search value on drill down.

If you want to open the search in new window then try this.

<condition match="$trellis.value$=&quot;Error&quot;">
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" $trellis.value$</link>
          </condition>
          <condition match="$trellis.value$=&quot;Info&quot;">
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$</link>
          </condition>
          <condition match="$trellis.value$=&quot;Warn&quot;">
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" $trellis.value$</link>
          </condition>
          <condition>
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="*" sourcetype="meridium:webapi" $trellis.value$</link>
          </condition>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

ritupatil02 · ‎06-24-2021

@kamlesh_vaghela

Why does the drilldown returns this query "(host="prod*") appn="APM - Meridium" rslt="*" sourcetype="meridium:webapi" $trellis.value$" when it should actually return "(host="prod*") appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi""

kamlesh_vaghela · ‎06-24-2021

@ritupatil02

You have used transpose command and then after fields - lvl. So may me due to that you unable to find $trellis.value$ during drilldown. That's Y I suggested stats command in my example.

But you can use the same search with below drilldown condition. Here direct field name is used in condition.

<condition match="$row.Error$>&quot;-1&quot;">
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" Error</link>
          </condition>
          <condition match="$row.Info$>&quot;-1&quot;">
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" Info</link>
          </condition>
          <condition match="$row.Warn$>&quot;-1&quot;">
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" Warn</link>
          </condition>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

ritupatil02 · ‎06-24-2021

@kamlesh_vaghela

That worked absolutely fine.. Thanks!! 🙂

Can we also add shared time range picker to the drilldown search?

kamlesh_vaghela · ‎06-24-2021

Yes @ritupatil02

Just append below code link.

&amp;earliest=$timeInput.earliest$&amp;latest=$timeInput.latest$

like

<condition match="$row.Error$&gt;&quot;-1&quot;">
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Failed" sourcetype="meridium:webapi" Error&amp;earliest=$timeInput.earliest$&amp;latest=$timeInput.latest$</link>
          </condition>
          <condition match="$row.Info$&gt;&quot;-1&quot;">
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" Info&amp;earliest=$timeInput.earliest$&amp;latest=$timeInput.latest$</link>
          </condition>
          <condition match="$row.Warn$&gt;&quot;-1&quot;">
            <link target="_blank">search?q=$envInput$ appn="APM - Meridium" rslt="Succeeded" sourcetype="meridium:webapi" Warn&amp;earliest=$timeInput.earliest$&amp;latest=$timeInput.latest$</link>
          </condition>

KV

ritupatil02 · ‎06-24-2021

@kamlesh_vaghela

Gives "Invalid character entity" error

kamlesh_vaghela · ‎06-24-2021

I have encode & to &

Check my updated answer.

Adding drilldown to trellis layout

drilldown

trellis layout

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

.conf24 | Registration Open!

ICYMI - Check out the latest releases of Splunk Edge Processor