Dashboards & Visualizations

Drilldown on only one row

krusovice
Path Finder

Hello,

I've one requirement which could be done using drilldown but I've no idea on the method to use.

This is the first panel to show to total request as one of the column.

 date_hour      Total Request      Toy Count     Play Count       Failed Count      % Failed
   1                 50               30            10               10                20%
   2                 40               20            10               10                25%

My requirement is to enable the user to only click on the "Total Request" and next panel is to have the list of request ID. For example, click on date_hour=1 and Total Request=50 will display next panel to show 50 Request ID. I tried the search but no luck in finding the solution to only drilldown based on one row selection.

Pls help, thank you.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

krusovice
Path Finder

Thank you @p_gurav, it's worked well 🙂

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...