Does Splunk Support drilldown within the same window/panel?

[dnv007]

What i mean to ask is,

1)Would it be possible to have a chart(any) and when clicked on a value the chart changes/displays values relevant to the click in the same panel?
2)Also, if the fields are common would the values change on other charts?

Basically want to know if it can work similar to Tableau.

[VatsalJagani · Accepted solution]

Hi @dnv007,
I think In-Page-Drilldown can solve your issue. You can add drilldown in XML of chart.

<panel>
   <table>
      <search>....</search>
      <drilldown>
         <set token="selected_value">$row.fieldname$</set>
       <drilldown>
   </table>
<panel>
<panel depends="$selected_value$">
   <single>
       <search>
            <query>| stats count | count=$selected_value$</query>
       <search>
    </single>
</panel>

Above dashboard initially have only one panel, once you select any value from it, it will open one more panel having selected value (here second panel is singleViewChart so supports only numbers). Here we are drilldown from table so we have used $row.fieldname$, replace fieldname with column name you want to use.

These drilldown tokens is available for all kind of charts.
https://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/PanelreferenceforSimplifiedXML#chart_.28event...

depends can be used with chart, panel and row element.

We can also set token conditionally. Explore more about drilldown and conditions. https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/PanelreferenceforSimplifiedXML#condition_.28d...

Check answer for full example - https://answers.splunk.com/answers/662719/how-to-create-a-drill-down-from-one-panel-to-anoth.html

[dnv007]

Hi Vatsal,

Thank you so much for a very helpful reply.

I just have one more question. Is this possible even on the 6 version? does this have version constraints?

Thanks and Regards,
Deepika

[VatsalJagani]

Yes Deepika, if you are talking about Splunk version 6. But I would recommend using 6.6.x version as the earlier versions of splunk6 might not have so many Splunk functions.