Dashboards & Visualizations

How to configure Drilldown after using transpose command?

Marco_Develops
Path Finder

After issuing a transpose command on my bar chart visualization I can't configure conditional drilldowns.

I tried using the untable command followed by the xyz series command and no luck.

this is the query:

 

search * 
| eval CATI = if(SEVCAT=="I", 1,0) 
| eval CATII = if(SEVCAT=="II", 1,0) 
| eval CATIII = if(SEVCAT=="III", 1,0) 
| chart sum(CATI) as I sum(CATII) as II sum(CATIII) as III
| transpose
| sort - "row 1"

 

 

The Drilldown XML :

 

<drilldown>
          <condition field = "I">
            <link target="blank"></link>
          </condition>
          <condition field = "II">
            <link target="blank"></link>
          </condition>
          <condition field = "III">
            <link target="blank"></link>
          </condition>
</drilldown>

 

 

Any help is appreciated.

Thank you, 
Marco

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

Marco_Develops
Path Finder

@ITWhisperer  Thank you!! Also,  great explanation.

-Marco

0 Karma

Gr0und_Z3r0
Contributor

Hi @Marco_Develops 

Try the following. Update your search this way..

your base search
|chart count over SEVCAT

 

And configure the dashboard panel drilldown to the following.

Gr0und_Z3r0_0-1650586299751.png


If it helps, karma points are appreciated!

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...