Dashboards & Visualizations

Clickable word cloud drilldown - must show details in another table in the same dashboard page

dojiepreji
Path Finder

Hello, I have a word cloud in my dashboard.

In my options for the word cloud, I have enabled tokenfields so that when a user clicks on a word, it will pass the value to the token.

 <option name="aiam-common-visual-6_4.wordcloud.tokenfields">[{
          "tokenname":"words",
          "tokenvalue":"click.name"
          }]</option>

I can display the token in the html using this code:

<panel>
      <html>
         <div>
           word: $words$
         </div>
       </html>
    </panel>

I have another table in the same dashboard that aims to display details in which this particular word is found.

<search>
          <query>index="aiam_itsm_ticket_beamsuntory" 
| search problem_abstract="*$words$*"
| table ticket, problem, status, group</query>
          <earliest>-1mon@mon</earliest>
          <latest>@mon</latest>
          <sampleRatio>1</sampleRatio>
        </search>

The problem is that the panel keeps displaying "Search is waiting for input..."

I want it to display the details for the selected word and refresh every time the user clicks on another word.

Any help would be appreciated. Thank you!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@dojiepreji ,

Until the token set , the search will not run and that's the reason for "Search is waiting for input.."

Either you can set the default value to the token on the page load , so that some default data is shown until the user 'clicks' on a word
Or
You can hide the panel using depends until the token is set i.e. user clicks on a word

With init

<dashboard>
  <init>
    <set token="sourcetype">"whatever the default value we want to set"</set>
  </init>
  <label>Token based Dashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal|stats count by sourcetype</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="sourcetype">$click.value$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype="$sourcetype$"|head 10</query>
          <earliest>-5m@m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

With depends

<dashboard>
  <label>Token based Dashboard</label>
  <row>
    <panel>
      <html>
        <h3><i>Click on a word to show the results</i></h3>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal|stats count by sourcetype</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="sourcetype">$click.value$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$sourcetype$">
      <table>
        <search>
          <query>index=_internal sourcetype="$sourcetype$"|head 10</query>
          <earliest>-5m@m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
Happy Splunking!
0 Karma

dojiepreji
Path Finder

Drilldown options doesn't work for this specific custom visualization, unfortunately.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

I think in your case, drill down can be replaced by click. So except the drilldown part ,init or depends should work for you if you are using simple xml

Happy Splunking!
0 Karma

dojiepreji
Path Finder

Can you please elaborate on how you can perform the click without drilldown?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...