Dashboards & Visualizations

How to configure Drilldown after using transpose command?

Marco_Develops
Path Finder

After issuing a transpose command on my bar chart visualization I can't configure conditional drilldowns.

I tried using the untable command followed by the xyz series command and no luck.

this is the query:

 

search * 
| eval CATI = if(SEVCAT=="I", 1,0) 
| eval CATII = if(SEVCAT=="II", 1,0) 
| eval CATIII = if(SEVCAT=="III", 1,0) 
| chart sum(CATI) as I sum(CATII) as II sum(CATIII) as III
| transpose
| sort - "row 1"

 

 

The Drilldown XML :

 

<drilldown>
          <condition field = "I">
            <link target="blank"></link>
          </condition>
          <condition field = "II">
            <link target="blank"></link>
          </condition>
          <condition field = "III">
            <link target="blank"></link>
          </condition>
</drilldown>

 

 

Any help is appreciated.

Thank you, 
Marco

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

Marco_Develops
Path Finder

@ITWhisperer  Thank you!! Also,  great explanation.

-Marco

0 Karma

Gr0und_Z3r0
Contributor

Hi @Marco_Develops 

Try the following. Update your search this way..

your base search
|chart count over SEVCAT

 

And configure the dashboard panel drilldown to the following.

Gr0und_Z3r0_0-1650586299751.png


If it helps, karma points are appreciated!

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...