Dashboards & Visualizations
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

How to Drilldown with depends in Number Display wiz?

michael_vi
Path Finder
‎07-18-2023 03:52 AM

Hi,

I'm trying to drill down to a panel with depends="$some token$" from the Number Display wiz, but instead to show/hide panel according to token, it opens a search.

I'm having trouble to make each of the 3 panels be dependable on token in Number Display wiz.

 

Please assist

image.png

 

 

<dashboard>
  <label>Show Panel based on Click</label>
  <row>
    <panel>
      <viz type="number_display_viz.number_display_viz">
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" 
| stats count by log_level</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="number_display_viz.number_display_viz.bordercolor">#ffffff</option>
        <option name="number_display_viz.number_display_viz.bordersize">2</option>
        <option name="number_display_viz.number_display_viz.colorprimary">#000000</option>
        <option name="number_display_viz.number_display_viz.colorprimarymode">auto</option>
        <option name="number_display_viz.number_display_viz.colorsecondary">#000000</option>
        <option name="number_display_viz.number_display_viz.colorsecondarymode">darker1</option>
        <option name="number_display_viz.number_display_viz.max">100</option>
        <option name="number_display_viz.number_display_viz.min">0</option>
        <option name="number_display_viz.number_display_viz.nodatacolor">#0178c7</option>
        <option name="number_display_viz.number_display_viz.padding">1</option>
        <option name="number_display_viz.number_display_viz.pulserate">4</option>
        <option name="number_display_viz.number_display_viz.shadowcolor">#F2F4F5</option>
        <option name="number_display_viz.number_display_viz.shapebordercolor">#FFFFFF</option>
        <option name="number_display_viz.number_display_viz.shapebordercolormode">static</option>
        <option name="number_display_viz.number_display_viz.shapebordersize">1</option>
        <option name="number_display_viz.number_display_viz.shapedropcolor">#ffffff</option>
        <option name="number_display_viz.number_display_viz.shapeshadow">yes</option>
        <option name="number_display_viz.number_display_viz.shapetexture">solid</option>
        <option name="number_display_viz.number_display_viz.sparkHeight">30</option>
        <option name="number_display_viz.number_display_viz.sparkWidth">90</option>
        <option name="number_display_viz.number_display_viz.sparkalign">5</option>
        <option name="number_display_viz.number_display_viz.sparkalignv">70</option>
        <option name="number_display_viz.number_display_viz.sparkcolorfill">#009DD9</option>
        <option name="number_display_viz.number_display_viz.sparkcolorline">#0178c7</option>
        <option name="number_display_viz.number_display_viz.sparkcolormodefill">auto</option>
        <option name="number_display_viz.number_display_viz.sparkcolormodeline">auto</option>
        <option name="number_display_viz.number_display_viz.sparkmin">0</option>
        <option name="number_display_viz.number_display_viz.sparknulls">gaps</option>
        <option name="number_display_viz.number_display_viz.sparkorder">no</option>
        <option name="number_display_viz.number_display_viz.sparkstyle">area</option>
        <option name="number_display_viz.number_display_viz.spinnerspeedmax">20</option>
        <option name="number_display_viz.number_display_viz.spinnerspeedmin">1</option>
        <option name="number_display_viz.number_display_viz.style">a2</option>
        <option name="number_display_viz.number_display_viz.subtitlealign">center</option>
        <option name="number_display_viz.number_display_viz.subtitlealignv">70</option>
        <option name="number_display_viz.number_display_viz.subtitlecolor">#5C6773</option>
        <option name="number_display_viz.number_display_viz.subtitlecolormode">static</option>
        <option name="number_display_viz.number_display_viz.subtitledrop">yes</option>
        <option name="number_display_viz.number_display_viz.subtitledropcolor">#ffffff</option>
        <option name="number_display_viz.number_display_viz.subtitlesize">40</option>
        <option name="number_display_viz.number_display_viz.textalign">center</option>
        <option name="number_display_viz.number_display_viz.textalignv">60</option>
        <option name="number_display_viz.number_display_viz.textcolor">#000000</option>
        <option name="number_display_viz.number_display_viz.textdrop">no</option>
        <option name="number_display_viz.number_display_viz.textdropcolor">#ffffff</option>
        <option name="number_display_viz.number_display_viz.textduration">300</option>
        <option name="number_display_viz.number_display_viz.textmode">static</option>
        <option name="number_display_viz.number_display_viz.textprecision">1</option>
        <option name="number_display_viz.number_display_viz.textsize">100</option>
        <option name="number_display_viz.number_display_viz.textunitposition">after</option>
        <option name="number_display_viz.number_display_viz.textunitsize">50</option>
        <option name="number_display_viz.number_display_viz.thickness">50</option>
        <option name="number_display_viz.number_display_viz.thresholdcol1">#1a9035</option>
        <option name="number_display_viz.number_display_viz.thresholdcol2">#d16f18</option>
        <option name="number_display_viz.number_display_viz.thresholdcol3">#b22b32</option>
        <option name="number_display_viz.number_display_viz.thresholdcol4">#ffffff</option>
        <option name="number_display_viz.number_display_viz.thresholdcol5">#ffffff</option>
        <option name="number_display_viz.number_display_viz.thresholdcol6">#ffffff</option>
        <option name="number_display_viz.number_display_viz.thresholdsize">20</option>
        <option name="number_display_viz.number_display_viz.thresholdval2">70</option>
        <option name="number_display_viz.number_display_viz.thresholdval3">90</option>
        <option name="number_display_viz.number_display_viz.titlealign">center</option>
        <option name="number_display_viz.number_display_viz.titlealignv">30</option>
        <option name="number_display_viz.number_display_viz.titlecolor">#edd051</option>
        <option name="number_display_viz.number_display_viz.titlecolormode">static</option>
        <option name="number_display_viz.number_display_viz.titledrop">no</option>
        <option name="number_display_viz.number_display_viz.titledropcolor">#ffffff</option>
        <option name="number_display_viz.number_display_viz.titlesize">65</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="INFO">
            <set token="tokINFO">true</set>
            <unset token="tokWARN"></unset>
            <unset token="tokERROR"></unset>
          </condition>
          <condition field="WARN">
            <unset token="tokINFO"></unset>
            <set token="tokWARN">true</set>
            <unset token="tokERROR"></unset>
          </condition>
          <condition field="ERROR">
            <unset token="tokINFO"></unset>
            <unset token="tokWARN"></unset>
            <set token="tokERROR">ERROR</set>
          </condition>
        </drilldown>
      </viz>
    </panel>
  </row>
  <row>
    <panel depends="$tokINFO$">
      <table>
        <title>INFO details</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="INFO" 
| timechart count by component</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$tokWARN$">
      <table>
        <title>WARN details</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="WARN" 
| timechart count by component</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel depends="$tokERROR$">
      <table>
        <title>ERROR details</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="ERROR" 
| timechart count by component</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</dashboard>

 

 

 

Labels (2)
Labels
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

bowesmana
SplunkTrust
SplunkTrust
‎07-18-2023 07:58 AM

@michael_vi 

In your table from stats count by log_level, you have two fields

1. log_level

2. count

so you change your drilldown section to

        <drilldown>
          <eval token="tokINFO">if($row.log_level$="INFO", 1, null())</eval>
          <eval token="tokWARN">if($row.log_level$="WARN", 1, null())</eval>
          <eval token="tokERROR">if($row.log_level$="ERROR", 1, null())</eval>
        </drilldown>

The reason why you are getting an open search is that you have conditions for 3 fields that don't exist, so it ends up using a default drilldown when you click those log_level or count fields. 

View solution in original post

Reply
Solved! Jump to solution
Solution

bowesmana
SplunkTrust
SplunkTrust
‎07-18-2023 07:58 AM

@michael_vi 

In your table from stats count by log_level, you have two fields

1. log_level

2. count

so you change your drilldown section to

        <drilldown>
          <eval token="tokINFO">if($row.log_level$="INFO", 1, null())</eval>
          <eval token="tokWARN">if($row.log_level$="WARN", 1, null())</eval>
          <eval token="tokERROR">if($row.log_level$="ERROR", 1, null())</eval>
        </drilldown>

The reason why you are getting an open search is that you have conditions for 3 fields that don't exist, so it ends up using a default drilldown when you click those log_level or count fields. 

Reply
Solved! Jump to solution

ITWhisperer
SplunkTrust
SplunkTrust
‎07-18-2023 05:34 AM

@chrisyounger Does this viz support drilldowns beyond $click.name$?

0 Karma
Reply
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...