Dashboards & Visualizations

Drilldown not working properly.

NicoloPunzalan2
Engager

Hi All,

I have a panel containing the top 10 resolution profiles of our tickets and I want to have a drilldown table which when I click the value of the Resolution Profile, there will be a table below which contains the ticket details like ticket number and assignment group.

My drilldown works fine with the top 1 resolution profile, but when I select other resolution profiles, It gets some other ticket details which is not the one that I clicked in the table. Can you help me please with my query? Please see below query that I have.

<search>
          <query>.......| stats count by u_resolution_profiles</query>
 </search>

<drilldown>
    <set token="Value_tkn">$click.value$</set>
</drilldown>

<table depends="$Value_tkn$">
 <search>
          <query>.......|search $Value_tkn$| table ticket_number u_resolution_profiles assignment_group assigned_to| rename ticket_number as "Ticket Number" u_resolution_profiles as "Resolution Profile" assignment_group as "Assignment Group" assigned_to as "Assigned To"</query>

Thanks in advance,
Nicolo

0 Karma
1 Solution

mayurr98
Super Champion

try specifying field names in search
| search u_resolution_profiles="$Value_tkn$"

Also when you click on the panel open the drill down in the new search and look what is getting substituted. I am sure you will get an answer if you open the drilldown panel in search.

View solution in original post

mayurr98
Super Champion

try specifying field names in search
| search u_resolution_profiles="$Value_tkn$"

Also when you click on the panel open the drill down in the new search and look what is getting substituted. I am sure you will get an answer if you open the drilldown panel in search.

NicoloPunzalan2
Engager

Hi @mayurr98,

Have tried the changes and worked properly. Thanks a lot!
Hope you have a good day ahead.

All the best,
Nicolo

0 Karma

niketn
Legend

@NicoloPunzalan24, I have converted to Answers. Please Accept to mark this as answered. Also up vote the comment/s that helped 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Yunagi
Communicator

Have a look at Define tokens for dynamic drilldown

I suggest the following changes:

<drilldown>
  <condition field="u_resolution_profiles">
    <set token="Value_tkn">$click.value2$</set>
  </condition>
</drilldown>

Also, change your other search to:

<query>....... | search u_resolution_profiles="$Value_tkn$" | .......
0 Karma

mayurr98
Super Champion

hey @NicoloPunzalan24
in your search query put

| search "$Value_tkn$"

"" in query and try again

let me know if it helps!

0 Karma

NicoloPunzalan2
Engager

Hi @mayurr98,

I tried to add them but it still doesn't work. 😞

Thanks,
Nicolo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...