Dashboards & Visualizations

How to configure Drilldown after using transpose command?

Marco_Develops
Path Finder

After issuing a transpose command on my bar chart visualization I can't configure conditional drilldowns.

I tried using the untable command followed by the xyz series command and no luck.

this is the query:

 

search * 
| eval CATI = if(SEVCAT=="I", 1,0) 
| eval CATII = if(SEVCAT=="II", 1,0) 
| eval CATIII = if(SEVCAT=="III", 1,0) 
| chart sum(CATI) as I sum(CATII) as II sum(CATIII) as III
| transpose
| sort - "row 1"

 

 

The Drilldown XML :

 

<drilldown>
          <condition field = "I">
            <link target="blank"></link>
          </condition>
          <condition field = "II">
            <link target="blank"></link>
          </condition>
          <condition field = "III">
            <link target="blank"></link>
          </condition>
</drilldown>

 

 

Any help is appreciated.

Thank you, 
Marco

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

Marco_Develops
Path Finder

@ITWhisperer  Thank you!! Also,  great explanation.

-Marco

0 Karma

Gr0und_Z3r0
Contributor

Hi @Marco_Develops 

Try the following. Update your search this way..

your base search
|chart count over SEVCAT

 

And configure the dashboard panel drilldown to the following.

Gr0und_Z3r0_0-1650586299751.png


If it helps, karma points are appreciated!

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...