Dashboards & Visualizations

Drill down into table - fields for display

paddy3883
Path Finder

I've created a dashboard which contains a summary table for which I want to have a drill down into a second table which shows the events related to that summary record. I have the drill down working and displaying the rows needed, however it is displaying all fields for that event rather than the specific ones I've set. If I run the search query on its own through the Search app, or separately on a dashboard it displays the appropriate fields.

This is the macro search code

source="MySource" EventClass="MyStep" $Transaction$ | dedup StepName | convert ctime(_time) as Date| table StepName, Date, EventStatus, Timing.

Here is the XML for the dashboard:

<?xml version='1.0' encoding='utf-8'?>
<view refresh="900" template="dashboard.html">
<label>Synthetics Dashboard</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Sythetic Transaction Recent Status" autoRun="True">
<param name="search">
synthetics_transactionStatus(SyntheticTransaction)</param>
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
<module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Login Timing Last 4hrs">
<param name="search">synthetics_transactionSteps($Transaction$)</param>
<module name="ConvertToIntention">
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="Transaction">
<param name="value">$click.value$</param>
</param>
</param>
</param>
<module name="ConvertToDrilldownSearch">
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
</module>
</module>
</module>
</module>
</module>
</module>
</view>

Thanks in advance

Tags (1)
0 Karma
1 Solution

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

View solution in original post

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

aneeshkjm123
Path Finder

Nice post !

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...