Dashboards & Visualizations

Drill down into table - fields for display

paddy3883
Path Finder

I've created a dashboard which contains a summary table for which I want to have a drill down into a second table which shows the events related to that summary record. I have the drill down working and displaying the rows needed, however it is displaying all fields for that event rather than the specific ones I've set. If I run the search query on its own through the Search app, or separately on a dashboard it displays the appropriate fields.

This is the macro search code

source="MySource" EventClass="MyStep" $Transaction$ | dedup StepName | convert ctime(_time) as Date| table StepName, Date, EventStatus, Timing.

Here is the XML for the dashboard:

<?xml version='1.0' encoding='utf-8'?>
<view refresh="900" template="dashboard.html">
<label>Synthetics Dashboard</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Sythetic Transaction Recent Status" autoRun="True">
<param name="search">
synthetics_transactionStatus(SyntheticTransaction)</param>
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
<module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Login Timing Last 4hrs">
<param name="search">synthetics_transactionSteps($Transaction$)</param>
<module name="ConvertToIntention">
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="Transaction">
<param name="value">$click.value$</param>
</param>
</param>
</param>
<module name="ConvertToDrilldownSearch">
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
</module>
</module>
</module>
</module>
</module>
</module>
</view>

Thanks in advance

Tags (1)
0 Karma
1 Solution

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

View solution in original post

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

aneeshkjm123
Path Finder

Nice post !

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...