Dashboards & Visualizations

Drill Down behaviour question ?

zacksoft_wf
Contributor

I have a drill down enabled dashboard with base-searches powering the main panels and also some part of the drill down panels.  
 Lets say my main panels are A. Upon clicking on A    A1, A2,A3 panels open up.
Before implementing drilldowns, my older dashboard was showing all 4 panels(A, A1, A2, A3) the moment dashboard was loading up

My question is, 
 Does it mean that the SPL responsible for displaying result for drill-down panels A1,A2,A3 only begins to execute after I click in the  panel A ? OR the SPL for all the panel (A, A1,A2,A3 ) are executed all at once when I open the dashboard and the drill-down click merely stops me from seeing the drill-down panels output and the drilldown panels' result generating SPLs have already run in the background ?

I'm wondering, does/can the drilldown help in anyway in improving performance !!

Labels (1)
Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@zacksoft_wf 

Each search with valid query in the dashboard will execute regardless of panel visible or not.

The query is valid means, if there is No token used in search (plain search without any tokens used as a part of search ) OR any tokens which used in the search query are set with some values. If the search query is valid then it will execute on load of dashboard.

 

In your case, If your drilldown panels(A1,A2,A3,..) search query has token which set on the click of Panel A then it will execute only on the drilldown of panel A. So suggest to set a token in drilldown and use it in drilldown panels(A1,A2,A3,..) search query.

I hope this will help you.

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

 

 

 

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...