Dashboards & Visualizations

Enable or disable drilldown based on time range

sanjeev543
Communicator

Hi,

Is it possible to apply the drill down only when the selected time rage is met?
For example, I would like to enable the drill down only if I am selecting more than 7 days ago to in dashboard

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sanjeev543

Can you please try this? I have used search for getting count from search with particular condition. You can find it in below XML.

<form>
  <label>Test </label>
  <search>
    <query>
      | makeresults | addinfo | eval diff=info_max_time - info_min_time, day=round(diff/60/60/24,0) | where day>=7 
    </query>
    <earliest>$earliest$</earliest>
    <latest>$latest$</latest>
    <done>
      <set token="jobcount">$job.resultCount$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time">
      <label></label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$jobcount$ $drilldown_called$</title>
      <table>
        <search>
          <query> | makeresults | addinfo | eval diff=info_max_time - info_min_time, day=round(diff/60/60/24,0) </query>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <condition match="$jobcount$ != &quot;0&quot;">
            <set token="drilldown_called">True</set>
            <!-- KEEP DRILLDOWN LOGC HERE -->
          </condition>
          <condition>
            <unset token="drilldown_called"></unset>
            <!-- SKIP DRILL DOWN BY KEEPING BLANK -->
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sanjeev543

Can you please try this? I have used search for getting count from search with particular condition. You can find it in below XML.

<form>
  <label>Test </label>
  <search>
    <query>
      | makeresults | addinfo | eval diff=info_max_time - info_min_time, day=round(diff/60/60/24,0) | where day>=7 
    </query>
    <earliest>$earliest$</earliest>
    <latest>$latest$</latest>
    <done>
      <set token="jobcount">$job.resultCount$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time">
      <label></label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$jobcount$ $drilldown_called$</title>
      <table>
        <search>
          <query> | makeresults | addinfo | eval diff=info_max_time - info_min_time, day=round(diff/60/60/24,0) </query>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <condition match="$jobcount$ != &quot;0&quot;">
            <set token="drilldown_called">True</set>
            <!-- KEEP DRILLDOWN LOGC HERE -->
          </condition>
          <condition>
            <unset token="drilldown_called"></unset>
            <!-- SKIP DRILL DOWN BY KEEPING BLANK -->
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...