Help with single value drilldown into a new tab

[vrmandadi]

Hello,

I am trying to create a drilldown for a single value, on clicking it,a new dashboard should open in a new tab.

      `<option name="colorBy">value</option>
    <option name="colorMode">block</option>
    <option name="drilldown">all</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
    <option name="rangeValues">[100,200]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="trendInterval">-30m</option>
    <option name="underLabel">compared to $timepickr.earliest$ before</option>
    <option name="unitPosition">after</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="underLabel">compared to $timepickr.earliest$ before</option>

   <option name="linkFields">underlabel</option>
    <option name="linkView">404_error_srv</option>
   </single>

`
This XML is working but not going opening a new tab and I am using splunk 6.6, which says the underlabel and link fields are depricated.How can I get into another tab on clicking the single value number

[niketn]

Following is a run anywhere dashboard with drilldown which should try to open the dashboard with one earliest and latest time stamp and clicked count as three parameters. Based on your example URL, seems like you do not need any parameters. Get rid of Simple XML Single Value configurations which are deprecated like underLabel"(used twice in your example), linkFields and linkView

<dashboard>
  <label>Single Value Drilldown</label>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="ERROR"
| timechart count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
        <option name="rangeValues">[100,200]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">-30m</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <drilldown>
          <link target="_blank">/app/search/orphaned_scheduled_searches?log_level=$row.count$&amp;earliest=$earliest$&amp;latest=$latest$</link>
        </drilldown>
      </single>
    </panel>
  </row>
</dashboard>

[gcusello]

Hi vrmandadi,
using Splunk 6.6.x there is the possibility to use ui to define drilldown and choice to open a new tab or the same.
Anyway, the parameter to set new windows is

<drilldown>
     <link target="_blank">/app/myapp/mwdashboard</link>
</drilldown>

Bye.
Giuseppe

[vrmandadi]

Hello @cusello

I tried using t he parameter ,but no luck with it.It is not even opening the search on clicking nor to a new window

[gcusello]

I used on a test dashboard and runs!
could you share your drilldown option?
Bye.
Giuseppe

[vrmandadi]

<option name="drilldown">all</option>
<drilldown>
      <link target="_blank">/app/vams/404_error_cli</link>
 </drilldown>