Dashboards & Visualizations

Drilldown with column value when clicking on any row.

amerineni
Loves-to-Learn

Hello, I want to mimic a cell click even if we click anywhere in the row.

my query: ----- | table type, operationOrURI, status, channel, flow, deviceId, workflowId, identifier, timeStamp

<option name="drilldown">row</option>
        <drilldown>
           <condition field="*">
             <set token="operationOrURI">$row.operationOrURI$</set>
           </condition>
        </drilldown>

In this table i want to always pass "operationOrURI" no matter where the user clicks on that row. Click is not working with the above code. Appreciate for any help.

0 Karma
1 Solution

niketn
Legend

@amerineni, just get rid of <condition> block and it should work the way you expect:

     <drilldown>
          <set token="operationOrURI">$row.operationOrURI$</set>
     </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@amerineni, just get rid of <condition> block and it should work the way you expect:

     <drilldown>
          <set token="operationOrURI">$row.operationOrURI$</set>
     </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

amerineni
Loves-to-Learn

Did the same, but same response. Nothing is happening when i click.

row

$row.operationOrURI$

0 Karma

niketn
Legend

Following is run anywhere dashboard with two sample rows. You can click and column in the two rows (keep switching between first row and second to see a change in token $operationOrURI$)

<dashboard>
  <label>Drilldown Field Value</label>
  <row>
    <panel>
      <title>Clicked Row Token operationOrURI Value: $operationOrURI$</title>
      <table>
        <search>
          <query>|  makeresults
|  eval type="type1", operationOrURI="operation", status=200
|  table type, operationOrURI, status
|  append 
    [|  makeresults
|  eval type="type2", operationOrURI="URI", status=404
|  table type, operationOrURI, status]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="operationOrURI">$row.operationOrURI$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

If this does not solve what you are looking for then please add few rows of sample data (don't forget to mock up/anonymize sensitive information) for fields type, operationOrURI, status, channel, flow, deviceId, workflowId, identifier, timeStamp. This will help us assist you better.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

amerineni
Loves-to-Learn

Thanks for the quick response. Below is sample data. Its wierd that nothing is happening when i click with drilldown set token tag. Also why is your drilldown option set to "cell" instead of "row"

REQUEST_METRIC /shopping/continueToDeviceValidation S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:16:01
SERVICE_METRIC verifyAccountUnchanged S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:16:01
REQUEST_METRIC /shopping/showAccessoryCatalog S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:19:07
REQUEST_METRIC /upgrades/upgrade S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:20:47
PERFORMANCE PERFORMANCE NA CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:20:47
SERVICE_METRIC GetEligibleSalesScenarios S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:20:47

0 Karma

niketn
Legend

cell or row does not matter for the example. You can change to row if you want.
Can you add the data from the output of table command? That way it will be easier for me to look at what are the values of operationOrURI field.

Have you tried token filters like <set token="operationOrURI">$row.operationOrURI|s$</set> for escaping the value as string.

Have you displayed $operationOrURI$ somewhere like I am displaying in <panel> <title>? What value does it show when you click a row?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

amerineni
Loves-to-Learn

looks like i can't upload image here. Here is the link to the image.

https://photos.app.goo.gl/9hmRTGvhSuKtCBqZ2

The data i gave above is from table output.
When i click the row nothing is happening. No response.

0 Karma

niketn
Legend

Have you printed the token you are setting in the drilldown to test? Does it remain empty and keep showing up $row.operationOrURI$ even if you click on table row any where?Can you also add your existing drilldown code? Are you using drilldown to link to other dashboard or set a token?

You would require to make token value safe to be used as URL in case you are using <link> and not <set>: $row.operationOrURI|u$

http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters

Following is the updated Run Anywhere Dashboard with mocked up data as per your screenshot. You can see the token is being set as expected. Please do share how you are trying to utilize the token afterwards.

alt text

<dashboard>
  <label>Drilldown Field Value</label>
  <row>
    <panel>
      <title>Clicked Row Token operationOrURI Value: $operationOrURI$</title>
      <table>
        <search>
          <query>|  makeresults
|  eval "Event Type"="REQUEST_METRICS", operationOrURI="/shipping/continnueToPayment", status="S"
|  table "Event Type", operationOrURI, status
|  append 
    [|  makeresults
|  eval "Event Type"="SERVICE_METRICS", operationOrURI="getOrderDetails", status="NA"
|  table  "Event Type", operationOrURI, status]
|  append 
    [|  makeresults
|  eval "Event Type"="SERVICE_METRICS", operationOrURI="/getInstallmentPlanHistory", status="F"
|  table  "Event Type", operationOrURI, status]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="status">
          <colorPalette type="map">{"S":#65A637,"F":#D93F3C,"NA":#F7BC38}</colorPalette>
        </format>
        <drilldown>
          <set token="operationOrURI">$row.operationOrURI$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

I would also request you to get the Splunk Dashboard Examples app from splunkbase (https://splunkbase.splunk.com/app/1603/) which has a lot of examples for setting up tokens during drilldown.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

amerineni
Loves-to-Learn

sorry for the delay. My requirement is to not just set a token. Whatever the token that gets passed when we click the operatioURI column, i want the same tokens to be passed to the drilldown when the user clicks on any other column.

Just setting the token is not working. There is no drilldown happening. So i started using the link tag and internally constructed a splunk link with dynamic tokens. That is working fine.

Not sure if there is any better solution. Anyway thanks for your help.

0 Karma

niketn
Legend

@amerineni, if your intention is to pass on the drilldown token to a new dashboard you would need to use <link> option to pass default drilldown token. Since your original issue was that drilldown token itself was not getting set, we were assisting you with the same.

Seems like it is working now so please accept the answer if this has helped. Do check out Splunk Dashboard Examples app for various options available for drilldown within page to link to a new dashboard. If you are on Splunk Enterprise 6.6 or higher, drilldown option is available within Splunk UI through Edit Panel option. So for most of the basic drilldown scenarios you can directly set the token/link from the UI, which automatically generates the required Simple XML.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

adamblock2
Path Finder

If the condition statement is removed, I believe you will get the functionality you are looking for.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...