Dashboards & Visualizations

Condition value using a drilldown

dbcase
Motivator

Ok stumped (again......)

I have this drilldown code

<!-- Begin the conditional drill down -->
        <drilldown>
          <condition field="Trend">
            <unset token="tablevalue"></unset>
          </condition>
          <condition field="Current Cell Connectivity %">
            <unset token="tablevalue"></unset>
          </condition>
          <condition field="*">
            <set token="tablevariable">$click.value2$</set>
          </condition>
          <condition value="Cox Home Life - CHL">
            <set token="s_mso">Cox</set>
          </condition>
          <condition value="Cox Business Security Solutions - CBSS">
            <set token="s_mso">Coxsmb</set>
          </condition>
        </drilldown>
        <!-- End the conditional drill down -->

And the resulting chart

chart depends="$tablevariable$">
        <title>Expanded Cell Connectivity for - $tablevariable$</title>
        <search>
          <query>index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell"  |where mso=lower("$s_mso$") | eval stat_val=round(stat_val,2)| timechart  first(stat_val) as "Cell Connectivity"|</query>
          <earliest>0</earliest>
        </search>

What I'm hoping to do is this:

If the value in the table is Cox Home Life - CHL, set the $s_mso$ token to "Cox" and then in the query search where s_mso="Cox" (there is some upper to lowercase conversion there, but let's ignore that for now as I know it works)

The problem is that the chart never appears, it simply says Search is waiting for data. The only thing I can think of is that the token tablevariable isn't getting set but it should be due to the user click selection in the row.

0 Karma
1 Solution

sundareshr
Legend

First let me say that you do a fantastic job commenting your code. Even in dashboards 🙂

I think, the reason you don't see the chart is because the token tablevariable doesn't get set unless the first two conditions fail. In other words, if condition field=Trend OR field="Current Cell Connectivity %" is met, the third, fourth fifth, etc will not be met. Try adding tablevariable to all conditions, like this

*UPDATED*

 <drilldown>
     <condition field="MSO - Click for Expanded View">
         <set token="tablevariable">$click.value2$</set>
         <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL", "Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
     </condition>
     <condition field="*">
         <unset token="tablevariable"></unset>
     </condition>
 </change>
 </drilldown>

View solution in original post

0 Karma

sundareshr
Legend

First let me say that you do a fantastic job commenting your code. Even in dashboards 🙂

I think, the reason you don't see the chart is because the token tablevariable doesn't get set unless the first two conditions fail. In other words, if condition field=Trend OR field="Current Cell Connectivity %" is met, the third, fourth fifth, etc will not be met. Try adding tablevariable to all conditions, like this

*UPDATED*

 <drilldown>
     <condition field="MSO - Click for Expanded View">
         <set token="tablevariable">$click.value2$</set>
         <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL", "Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
     </condition>
     <condition field="*">
         <unset token="tablevariable"></unset>
     </condition>
 </change>
 </drilldown>
0 Karma

dbcase
Motivator

Awwww making me blush 🙂 If I didn't document I would be even more lost than I am today!!! 🙂

On the updated code I realized that I had tablevalue instead of tablevariable so I fixed that.

I only want tablevariable to be set if the user clicks on the first column so I guess I can rework that to make it simpler. I'll do that and post the update (maybe it will work -- fingers crossed)

0 Karma

dbcase
Motivator

Updated code

<!-- Begin the conditional drill down -->
        <drilldown>
          <condition field="MSO - Click for Expanded View">
            <set token="tablevariable">$click.value2$</set>
          </condition>
          <condition field="*">
            <unset token="tablevariable"></unset>
          </condition>

          <change>
          <condition tablevariable="Cox Home Life - CHL">
            <set token="s_mso">Cox</set>
          </condition>
          <condition tablevariable="Cox Business Security Solutions - CBSS">
            <set token="s_mso">Coxsmb</set>
          </condition>
          </change>
        </drilldown>
0 Karma

sundareshr
Legend

See if this works

<drilldown>
    <condition field="MSO - Click for Expanded View">
        <set token="tablevariable">$click.value2$</set>
        <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
    </condition>
    <condition field="*">
        <unset token="tablevariable"></unset>
    </condition>
</change>
</drilldown>
0 Karma

dbcase
Motivator

Hmmm I think you are close!

Cox Home Life - CHL should equal to "Cox"
Cox Business Security Solutions - CBSS should equal to "CBSS"

I tried poking around with the case statement to make that work but alas.... I made it NOT work 🙂

0 Karma

sundareshr
Legend

I updated the original answer, try that

0 Karma

dbcase
Motivator

Still no joy 😞

I included s_mso in the chart header.

Here is what it reads

Expanded Cell Connectivity for - Cox Home Life - CHL *

s_mso is getting set to *

0 Karma

dbcase
Motivator

Found it!!!! Removing the quotes from around $click.value2$ worked!

<eval token="s_mso">case($click.value2$="Cox Home Life - CHL", "Cox", $click.value2$="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>     </condition>

dbcase
Motivator

This is the update I tried

         <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL","Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
0 Karma

dbcase
Motivator

It seems like s_mso is getting set to *

0 Karma

dbcase
Motivator

A bit more info, if I remove where mso="$s_mso$" from the expanded query it shows the chart. The values are incorrect but the chart shows. Something about the s_mso token isn't quite right but for the life of me I can't see it.

0 Karma

dbcase
Motivator

Updated drilldown code (still no joy)

<!-- Begin the conditional drill down -->
        <drilldown>
          <condition field="Trend">
            <unset token="tablevariable"></unset>
          </condition>
          <condition field="Current Cell Connectivity %">
            <unset token="tablevariable"></unset>
          </condition>
          <condition field="*">
            <set token="tablevariable">$click.value2$</set>
          </condition>
          <condition tablevariable="Cox Home Life - CHL">
            <set token="s_mso">Cox</set>
          </condition>
          <condition tablevariable="Cox Business Security Solutions - CBSS">
            <set token="s_mso">Coxsmb</set>
          </condition>
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...