Dashboards & Visualizations

Drilldown on only one row

krusovice
Path Finder

Hello,

I've one requirement which could be done using drilldown but I've no idea on the method to use.

This is the first panel to show to total request as one of the column.

 date_hour      Total Request      Toy Count     Play Count       Failed Count      % Failed
   1                 50               30            10               10                20%
   2                 40               20            10               10                25%

My requirement is to enable the user to only click on the "Total Request" and next panel is to have the list of request ID. For example, click on date_hour=1 and Total Request=50 will display next panel to show 50 Request ID. I tried the search but no luck in finding the solution to only drilldown based on one row selection.

Pls help, thank you.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

krusovice
Path Finder

Thank you @p_gurav, it's worked well 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...