Dashboards & Visualizations

Display data from two rows when using drilldown

Splunk_noobie
Path Finder

Hi All,

 

I have a table with 5 rows as shown below.

Report      Count     Comments
Report 1    22         abc
Report 2    786        def
Report 3    10,037     ghi
Report 4    719        jkl

When I click on any row, it displays data for that row using the <option name="drilldown">row</option> in my template like this :

Hi Team, 
According to our Splunk logs below are the top reports having high count:  

Report: Report1
Comment: abc
Count: 22

If you have any questions please feel free to contact us. 

Regards 

Support Team

 ---------END of my display message----------

Now when I click 2nd row(after clicking the first row) I want 2nd-row data also to be displayed along with the above results so that the output looks like this: 

Hi Team, 
According to our Splunk logs below are the top reports having high count:  

Report: Report1
Comment: abc
Count: 22

Report: Report2
Comment: def
Count: 786

If you have any questions please feel free to contact us. 

Regards 

Support Team

 ---------END of my display message----------

 

 

 

This is the code I have used : 

 

<row> 
<panel> 
<table> 
<title>click a row for more details</title> 
<search base="main_search"> <query>| table reportName count comments</query> 
</search> 
<option name="count">10</option> 
<option name="dataOverlayMode">none</option> 
<option name="drilldown">row</option> 
<option name="refresh.display">progressbar</option>
 <option name="rowNumbers">false</option> 
<option name="wrap">true</option> 
<fields>$table_fields$</fields> 
<drilldown> 
<eval token="customer_comment_en"> 
" Report: ".$ReportId$." 
Count: ".$count$." 
Comments: ".$comment$." 
" 
</eval> 
<set token="drilldown_display">block</set> 
</drilldown> 
</table> 
</panel> 
</row> 
<row depends="$drilldown_display$"> 
<panel> <html> <h1 class="SectionHeader">Customer Communication</h1> <div style="float:left; width:calc(95% - 50px);" class="pageInfo"> 
<pre> 
Hi Team, According to our splunk logs below are the top reports having high count: 
$customer_comment_en$ 

If you have any questions please feel free to contact us. 
Regards Support Team 
</pre> 
</div> 
</html> 
</panel> 
<panel> 

 

Basically, I want to access data for not just one row, but multiple rows when I click on them and display

Can anyone help?

 

 

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Duplicate - it looks like the community is having problems - replies don't appear to be being accepted, but they are there when a refresh is done so it might be true when posting a new topic

0 Karma

Splunk_noobie
Path Finder

@ITWhisperer Could you please suggest what to do here?

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Follow the original post 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...