Dashboards & Visualizations

How can I drilldown values from a hidden field?

pamcarvalho
Path Finder

Hey!

I am building a dashboard and this problem is being a headache. I really need to find a way to drilldown values from hidden fields and/or panels, but not sure how to do so.. Can anyone help me, please?
Thanks in advance!

0 Karma
1 Solution

jeffland
Champion

Based on your comments, what you might be looking for is something like this:

<table>
  <search>
    <query>data=A | table info date</query>
  </search>
  <drilldown>
    <eval token="drilldown_token">strftime(strptime('row.date', "%F"), "%d.%m.%Y")</eval>
  </drilldown>
</table>
...
<table depends="$drilldown_token$">
  <search>
    <query>data=B | search other_date="$drilldown_token$"</query>
  </search>
</table>

This allows you to have a value passed to the drilldown that is not visible in the table you drilled down from. In the case above, imagine having a date like "2017-10-19" in the table you drill down from while you need it as "19.10.2017" in your target search.

View solution in original post

jeffland
Champion

Based on your comments, what you might be looking for is something like this:

<table>
  <search>
    <query>data=A | table info date</query>
  </search>
  <drilldown>
    <eval token="drilldown_token">strftime(strptime('row.date', "%F"), "%d.%m.%Y")</eval>
  </drilldown>
</table>
...
<table depends="$drilldown_token$">
  <search>
    <query>data=B | search other_date="$drilldown_token$"</query>
  </search>
</table>

This allows you to have a value passed to the drilldown that is not visible in the table you drilled down from. In the case above, imagine having a date like "2017-10-19" in the table you drill down from while you need it as "19.10.2017" in your target search.

View solution in original post

pamcarvalho
Path Finder

Yes!!!! That's it! Thank you very much!

0 Karma

pamcarvalho
Path Finder

Just an update, this wasn't working for me but I found a way to do it, so in case that helps anyone, this is what I did:

<drilldown>
          <eval token="EOEDDE">strftime('earliest',"%d/%m/%y")</eval>
          <eval token="EOEDDL">strftime('latest',"%d/%m/%y")</eval>
          <set token="EOEDD">$earliest$</set>
          <set token="EOLDD">$latest$</set>
</drilldown>

I used "EOEDDE" and "EOEDDL" for the panel title. "EOEDD" and "EOLDD" to generate results to a table.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi pamcarvalho,
create your search, e.g.:

index=my_index
| table _time field1 field2 hidden_field

in the panel options put the tag

<fields>_time,field1,field2</fields>

then in drilldown you can use hidden_field

Bye.
Giuseppe

pamcarvalho
Path Finder

But that only works assuming that someone clicks on the table right? Is there a way do display the field value without depending on that?

0 Karma

pamcarvalho
Path Finder

For example, a hidden panel that has a table with only one field value. Is it possible to drilldown this value?

0 Karma

gcusello
SplunkTrust
SplunkTrust

a drilldown starts always from a click on a Splunk object!
Do you want to automatically open a dashboard from another one?
Why?
bye.
Giuseppe

0 Karma

pamcarvalho
Path Finder

No, l want to drilldown a value, change its format and then drilldown the new value. But the intermediary value shouldn't show up.. Not sure if I made myself clear..

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.