Dashboards & Visualizations

How to close or hide a drilldown panel

aditsss
Motivator

Hi Everyone,

I need some help here.

I have a panel with a with a numeric value and it has a drilldown panel.

when we click on that numeric value one drilldown panel is open and that is table.

Now what I want to happen is that the user can close or hide the drilldown panel when it is not needed anymore.
How is it possible?

Main panel code


<panel>
<single>
<title>TIME</title>
<search>
<query>index="abc" sourcetype=xyz Timeout $Org$ | bin span=1d _time |stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="unit"></option>
<option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option>
<option name="useColors">1</option>
<option name="showSparkline">1</option>
<option name="trendDisplayMode">percent</option>
<drilldown>
<set token="show_panel3">true</set>
<set token="selected_value3">$click.value$</set>
</drilldown>
</single>
</panel>

 

Drilldown panel

<panel depends="$show_panel3$">
<title>Statistics of Timeout Exceptions</title>
<table>
<title>Time Exceptions</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout |stats count by URL | sort -count </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
</table>
</panel>

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Give the input an empty label

<label></label>

 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried having a drilldown in the drilldown panel that unsets show_panel3?

<panel depends="$show_panel3$">
<title>Statistics of Timeout Exceptions</title>
<table>
<title>Time Exceptions</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout |stats count by URL | sort -count </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
<option name="drilldown">row</option>
<drilldown>
<unset token="show_panel3"/>
</drilldown>
</table>
</panel>

You may need the <unset token="show_panel3"/> in your <init> section at the top of the dashboard if you haven't already got it

aditsss
Motivator

Hi ITWhisperer,

Yes, I have tried this way and its closing on clicking of row.

Is there any way that I can create one cross button or close button on top of the drill-down dashboard which by clicking on which dashboard will close .

Rather then clicking on row. Can you suggest me on that.

XML code

Main panel code


<panel>
<single>
<title>TIME</title>
<search>
<query>index="abc" sourcetype=xyz Timeout $Org$ | bin span=1d _time |stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="unit"></option>
<option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option>
<option name="useColors">1</option>
<option name="showSparkline">1</option>
<option name="trendDisplayMode">percent</option>
<drilldown>
<set token="show_panel3">true</set>
<set token="selected_value3">$click.value$</set>
</drilldown>
</single>
</panel>

 

Drilldown panel

<panel depends="$show_panel3$">
<title>Statistics of Timeout Exceptions</title>
<table>
<title>Time Exceptions</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout |stats count by URL | sort -count </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
</table>
</panel>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could set a condition in the drilldown of the drilldown panel so that it only unsets the token if the first row is clicked or if you change the option to cell you could only unset if the first cell of the first row is clicked.

Another possibility is having an additional row with the hide button which uses the same depends as the drilldown panel i.e. it is only shown when the drilldown panel is visible

0 Karma

aditsss
Motivator

Hi ITWhisperer,

I have  tried this in My drill down panel. By clicking on the rows of the drill down panel the panel is getting closed.

I want if I can put one small button on drill-down dashboard by clicking on which I can close the drill down dashboard manually rather then setting tokens.

XML for drill down dashboard

<panel depends="$show_panel3$">
<title>Statistics of Timeout Exceptions</title>
<table>
<title>Timeout Exceptions</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout |stats count by URL | sort -count </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
<option name="drilldown">row</option>
<drilldown>
<unset token="show_panel3">true</unset>
</drilldown>
</table>
</panel>

0 Karma

aditsss
Motivator

Hi ITWhisperer,

 

Can you provide me the code for this if possible.

So that I can create one close button on the top of hidden panel if possible.So that I can close that manually.

Another possibility is having an additional row with the hide button which uses the same depends as the drilldown panel i.e. it is only shown when the drilldown panel is visible

Thanks in advance

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
  <row>
    <panel depends="$show_panel3$">
      <input type="link" token="tokLinkHideTable" searchWhenChanged="true">
        <label></label>
        <choice value="hideTable">Hide table</choice>
        <change>
          <condition value="hideTable">
            <unset token="form.tokLinkHideTable"></unset>
            <unset token="show_panel3"></unset>
          </condition>
        </change>
      </input>
    </panel>
  </row>

 

aditsss
Motivator

Hi ITWhisperer,

Yes this is closing the stastics table but I dont want "toklinkhidetable" token to be displayed on UI. I want only hidetable value is there. Is there any way we can remove this token value from UI. I have attached the screenshot.

XML code

 

<panel depends="$show_panel3$">
<input type="link" token="tokLinkHideTable" searchWhenChanged="true">
<choice value="hideTable">Hide table</choice>
<change>
<condition value="hideTable">
<unset token="form.tokLinkHideTable"></unset>
<unset token="show_panel3"></unset>
</condition>
</change>
</input>
<title>Statistics of Timeout Exceptions</title>
<table>
<title>Timeout Exceptions</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout |stats count by URL | sort -count </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
</table>
</panel>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Give the input an empty label

<label></label>

 

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...