Dashboards & Visualizations

Help required with Simple XML DrillDown

Path Finder

Hi All,

I have the following search query as a drilldown as part of the Simple XML Dashboard.

<drilldown>   <link>
    /app/cms-fortiweb/flashtimeline?q=`fortiweb_attack` earliest=-30d@d latest=now  | search policy="$row.Policy Violations"   </link> </drilldown>

I have the same drilldown added for two panels. One panel has the visualization as Table and other other as Pie chart.

So when i click on the Table to drilldown from my Dashboard, the drill down works fine by substituting the row value.

But the same does not work when i try to drilldown from a PIE Chart.

What could be the mistake here. Please provide your thoughts on this.

0 Karma

Splunk Employee
Splunk Employee

If you are running Splunk 6.1+, here is a simple tool to help display the available click information available on drilldown. This test tool attempts to set any/all applicable click information as tokens, and then uses an html element to render the token values.

  <label>Drilldown Tester</label>
  <fieldset submitButton="false">
    <input type="time" token="field1">
        <searchString>index=_internal | timechart count by sourcetype</searchString>
        <option name="charting.drilldown">all</option>
          <set token="chart1.click.name">$click.name$</set>
          <set token="chart1.click.name2">$click.name2$</set>
          <set token="chart1.click.value">$click.value$</set>
          <set token="chart1.click.value2">$click.value2$</set>
          <set token="chart1.row.sourcetype">$row.sourcetype$</set>
          <set token="chart1.earliest">$earliest$</set>
          <set token="chart1.latest">$latest$</set>
            <code>click.name: $chart1.click.name$</code>
            <code>click.name2: $chart1.click.name2$</code>
            <code>click.value: $chart1.click.value|s$</code>
            <code>click.value2: $chart1.click.value2|s$</code>
            <code>row.sourcetype = $chart1.row.sourcetype$</code>
            <code>Timerange: $chart1.earliest$ - $chart1.latest$</code>

alt text

Path Finder


Im making use of Splunk 5.0.4 . So i dont think that i can make use of the item which you have suggested above 😞

0 Karma