Dashboards & Visualizations

Can you help me with my drill down dashboard?

grreddy
New Member

Hello Splunkers,

I created an internal drill down dashboard. But, when I tried to click a particular row in thedashboard, it didn't select. And, another row is also not getting to the results. Please help what is error i didnt get.

test1

<panel>
  <table>
    <search>
      <query>index=king | top 5 clientip</query>
      <earliest>0</earliest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="drilldown">row</option>
    <option name="count">20</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">none</option>
    <option name="percentagesRow">false</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
    <drilldown>
      <set token="tokentest">$row.clientip$</set>
    </drilldown>
  </table>
</panel>


<panel>
  <table>
    <search>
      <query>index=king clientip=$tokentest$ | stats count by categoryId</query>
    </search>
  </table>
</panel>

alt text

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@grreddy

Can you please set drilldown option row??

 <option name="drilldown">row</option>

Thanks

Ref: https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/DrilldownIntro

0 Karma

grreddy
New Member

its kk fine ,but problem is ,iam already create sample dashboard in the stats format.i try to cleck the row or cell ,its dose not select.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please share full XML with sample searches ( dummy index name,sourcetype and field name) ??

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...