Dashboards & Visualizations

Can you help me with my drilldown issue involving a URL?

Shan
Builder

I have a problem in drilldown. Please help me out.

When i click on the field(Ticket) value, it will open up the drilldown panel. When i click on the value in (index=_internal | table *) query.

As i mention below, a Wikipedia url to web page will be navigated from the drilldown panel of the dashboard(working perfect). But, in the dashboard, the drilldown result is not showing up once i click the value in (index=_internal | table *) query and navigated to external url(wikipedia).

Please let me know why the drilldown result is hiding when i click the value in (index=_internal | table *) and is moving to external url(wikipedia).

I have provided sample drilldown below.

<drilldown>
          <condition field="Months">
            <set token="Month_depend">true</set>
            <set token="Months">$row.Months$</set>
            <set token="Notsolved">$row.Ticket$</set>
            <set token="Breached">$row.overdue$</set>
            <unset token="seconds"></unset>
            <unset token="Low"></unset>      
            </condition>
          <condition field="Ticket">
            <set token="Ticket">$row.Ticket$</set>
            <set token="seconds">true</set>
            <set token="Months">$row.Months$</set>
            <unset token="Month_depend"></unset>
            <unset token="Low"></unset>
            </condition>      
        </drilldown>     
  <row>
    <panel>
      <title>$Months$</title>
      <table depends="$seconds$">
        <title> </title>
        <search>
          <query>index=_internal | table * </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">
            <![CDATA[https://en.wikipedia.org/wiki/Data]]>
          </link>
          <unset token="seconds"></unset>
        </drilldown>
      </table>
    </panel>
  </row>

Thanks ..

0 Karma
1 Solution

renjith_nair
Legend

@shankarananth,

That's because your drilldown panel is depending on the token seconds as defined in <table depends="$seconds$"> and then you are resetting the token in the drilldown using <unset token="seconds"></unset> .

So, if you do not want your detailed panel (index=_internal | table *) to be hidden when clicking on the link drilldown, just remove the unset option. However, that will keep the panel visible all the time once the seconds token is set.

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@shankarananth,

That's because your drilldown panel is depending on the token seconds as defined in <table depends="$seconds$"> and then you are resetting the token in the drilldown using <unset token="seconds"></unset> .

So, if you do not want your detailed panel (index=_internal | table *) to be hidden when clicking on the link drilldown, just remove the unset option. However, that will keep the panel visible all the time once the seconds token is set.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Shan
Builder

@ renjith.nair,

Thanks for the reply :-)..
Let me try from my end and update you ..

Thanks ..

0 Karma

Shan
Builder

@ renjith.nair,

Thank you .. It's working..

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...