Dashboards & Visualizations

Display data from two rows when using drilldown

Splunk_noobie
Path Finder

Hi All,

 

I have a table with 5 rows as shown below.

Report      Count     Comments
Report 1    22         abc
Report 2    786        def
Report 3    10,037     ghi
Report 4    719        jkl

When I click on any row, it displays data for that row using the <option name="drilldown">row</option> in my template like this :

Hi Team, 
According to our Splunk logs below are the top reports having high count:  

Report: Report1
Comment: abc
Count: 22

If you have any questions please feel free to contact us. 

Regards 

Support Team

 ---------END of my display message----------

Now when I click 2nd row(after clicking the first row) I want 2nd-row data also to be displayed along with the above results so that the output looks like this: 

Hi Team, 
According to our Splunk logs below are the top reports having high count:  

Report: Report1
Comment: abc
Count: 22

Report: Report2
Comment: def
Count: 786

If you have any questions please feel free to contact us. 

Regards 

Support Team

 ---------END of my display message----------

 

 

 

This is the code I have used : 

 

<row> 
<panel> 
<table> 
<title>click a row for more details</title> 
<search base="main_search"> <query>| table reportName count comments</query> 
</search> 
<option name="count">10</option> 
<option name="dataOverlayMode">none</option> 
<option name="drilldown">row</option> 
<option name="refresh.display">progressbar</option>
 <option name="rowNumbers">false</option> 
<option name="wrap">true</option> 
<fields>$table_fields$</fields> 
<drilldown> 
<eval token="customer_comment_en"> 
" Report: ".$ReportId$." 
Count: ".$count$." 
Comments: ".$comment$." 
" 
</eval> 
<set token="drilldown_display">block</set> 
</drilldown> 
</table> 
</panel> 
</row> 
<row depends="$drilldown_display$"> 
<panel> <html> <h1 class="SectionHeader">Customer Communication</h1> <div style="float:left; width:calc(95% - 50px);" class="pageInfo"> 
<pre> 
Hi Team, According to our splunk logs below are the top reports having high count: 
$customer_comment_en$ 

If you have any questions please feel free to contact us. 
Regards Support Team 
</pre> 
</div> 
</html> 
</panel> 
<panel> 

 

Basically, I want to access data for not just one row, but multiple rows when I click on them and display

Can anyone help?

 

 

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Duplicate - it looks like the community is having problems - replies don't appear to be being accepted, but they are there when a refresh is done so it might be true when posting a new topic

0 Karma

Splunk_noobie
Path Finder

@ITWhisperer Could you please suggest what to do here?

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Follow the original post 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...