Dashboards & Visualizations

Drill down on table from a cell not working fine

architkhanna
Path Finder

I have a table like this

1 5 6 7 8
2 A B C D
3 E F G H

I want to make drill down in such a way that on click of any of alphabets, the respective column heading should pass ( which is 5 6 7 or 😎

0 Karma

niketn
Legend

@architkhanna try one of default drilldown token $click.name2$

    <drilldown>
      <set token="tokClickedColumnName">$click.name2$</set>
    </drilldown>

Following is a run anywhere search based on sample data provided:

<dashboard>
  <label>Table with drilldown</label>
  <row>
    <panel>
      <title>$tokClickedColumnName$</title>
      <table>
        <search>
          <query>| makeresults
| fields - _time
| eval data="2 A B C D;3 E F G H"
| makemv data delim=";"
| mvexpand data
| makemv data delim=" "
| eval 1=mvindex(data,0), 5=mvindex(data,1), 6=mvindex(data,2), 7=mvindex(data,3), 8=mvindex(data,4)
| fields - data</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="tokClickedColumnName">$click.name2$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

gcusello
SplunkTrust
SplunkTrust

Hi architkhanna,
can you share your search?
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...