Dashboards & Visualizations

Drill down into table - fields for display

paddy3883
Path Finder

I've created a dashboard which contains a summary table for which I want to have a drill down into a second table which shows the events related to that summary record. I have the drill down working and displaying the rows needed, however it is displaying all fields for that event rather than the specific ones I've set. If I run the search query on its own through the Search app, or separately on a dashboard it displays the appropriate fields.

This is the macro search code

source="MySource" EventClass="MyStep" $Transaction$ | dedup StepName | convert ctime(_time) as Date| table StepName, Date, EventStatus, Timing.

Here is the XML for the dashboard:

<?xml version='1.0' encoding='utf-8'?>
<view refresh="900" template="dashboard.html">
<label>Synthetics Dashboard</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Sythetic Transaction Recent Status" autoRun="True">
<param name="search">
synthetics_transactionStatus(SyntheticTransaction)</param>
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
<module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Login Timing Last 4hrs">
<param name="search">synthetics_transactionSteps($Transaction$)</param>
<module name="ConvertToIntention">
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="Transaction">
<param name="value">$click.value$</param>
</param>
</param>
</param>
<module name="ConvertToDrilldownSearch">
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
</module>
</module>
</module>
</module>
</module>
</module>
</view>

Thanks in advance

Tags (1)
0 Karma
1 Solution

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

View solution in original post

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

aneeshkjm123
Path Finder

Nice post !

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...