Dashboards & Visualizations

Drill down into table - fields for display

paddy3883
Path Finder

I've created a dashboard which contains a summary table for which I want to have a drill down into a second table which shows the events related to that summary record. I have the drill down working and displaying the rows needed, however it is displaying all fields for that event rather than the specific ones I've set. If I run the search query on its own through the Search app, or separately on a dashboard it displays the appropriate fields.

This is the macro search code

source="MySource" EventClass="MyStep" $Transaction$ | dedup StepName | convert ctime(_time) as Date| table StepName, Date, EventStatus, Timing.

Here is the XML for the dashboard:

<?xml version='1.0' encoding='utf-8'?>
<view refresh="900" template="dashboard.html">
<label>Synthetics Dashboard</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Sythetic Transaction Recent Status" autoRun="True">
<param name="search">
synthetics_transactionStatus(SyntheticTransaction)</param>
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
<module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Login Timing Last 4hrs">
<param name="search">synthetics_transactionSteps($Transaction$)</param>
<module name="ConvertToIntention">
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="Transaction">
<param name="value">$click.value$</param>
</param>
</param>
</param>
<module name="ConvertToDrilldownSearch">
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
</module>
</module>
</module>
</module>
</module>
</module>
</view>

Thanks in advance

Tags (1)
0 Karma
1 Solution

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

View solution in original post

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

aneeshkjm123
Path Finder

Nice post !

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...