Dashboards & Visualizations

Drilldown on only one row

krusovice
Path Finder

Hello,

I've one requirement which could be done using drilldown but I've no idea on the method to use.

This is the first panel to show to total request as one of the column.

 date_hour      Total Request      Toy Count     Play Count       Failed Count      % Failed
   1                 50               30            10               10                20%
   2                 40               20            10               10                25%

My requirement is to enable the user to only click on the "Total Request" and next panel is to have the list of request ID. For example, click on date_hour=1 and Total Request=50 will display next panel to show 50 Request ID. I tried the search but no luck in finding the solution to only drilldown based on one row selection.

Pls help, thank you.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

krusovice
Path Finder

Thank you @p_gurav, it's worked well 🙂

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...