Dashboards & Visualizations

Display data from two rows when using drilldown

Splunk_noobie
Path Finder

Hi All,

 

I have a table with 5 rows as shown below.

Report      Count     Comments
Report 1    22         abc
Report 2    786        def
Report 3    10,037     ghi
Report 4    719        jkl

When I click on any row, it displays data for that row using the <option name="drilldown">row</option> in my template like this :

Hi Team, 
According to our Splunk logs below are the top reports having high count:  

Report: Report1
Comment: abc
Count: 22

If you have any questions please feel free to contact us. 

Regards 

Support Team

 ---------END of my display message----------

Now when I click 2nd row(after clicking the first row) I want 2nd-row data also to be displayed along with the above results so that the output looks like this: 

Hi Team, 
According to our Splunk logs below are the top reports having high count:  

Report: Report1
Comment: abc
Count: 22

Report: Report2
Comment: def
Count: 786

If you have any questions please feel free to contact us. 

Regards 

Support Team

 ---------END of my display message----------

 

 

 

This is the code I have used : 

 

<row> 
<panel> 
<table> 
<title>click a row for more details</title> 
<search base="main_search"> <query>| table reportName count comments</query> 
</search> 
<option name="count">10</option> 
<option name="dataOverlayMode">none</option> 
<option name="drilldown">row</option> 
<option name="refresh.display">progressbar</option>
 <option name="rowNumbers">false</option> 
<option name="wrap">true</option> 
<fields>$table_fields$</fields> 
<drilldown> 
<eval token="customer_comment_en"> 
" Report: ".$ReportId$." 
Count: ".$count$." 
Comments: ".$comment$." 
" 
</eval> 
<set token="drilldown_display">block</set> 
</drilldown> 
</table> 
</panel> 
</row> 
<row depends="$drilldown_display$"> 
<panel> <html> <h1 class="SectionHeader">Customer Communication</h1> <div style="float:left; width:calc(95% - 50px);" class="pageInfo"> 
<pre> 
Hi Team, According to our splunk logs below are the top reports having high count: 
$customer_comment_en$ 

If you have any questions please feel free to contact us. 
Regards Support Team 
</pre> 
</div> 
</html> 
</panel> 
<panel> 

 

Basically, I want to access data for not just one row, but multiple rows when I click on them and display

Can anyone help?

 

 

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Duplicate - it looks like the community is having problems - replies don't appear to be being accepted, but they are there when a refresh is done so it might be true when posting a new topic

0 Karma

Splunk_noobie
Path Finder

@ITWhisperer Could you please suggest what to do here?

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Follow the original post 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mile High Learning with Splunk University, Denver, Colorado

If Denver is known for its mile-high elevation, Splunk University is about to raise the bar on technical ...

IT Service Intelligence 5.0 Series: Your Guide to the June Launch

We are excited to announce the June release of Splunk IT Service Intelligence (ITSI) 5.0. This update ...

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...