Dashboards & Visualizations

How to configure Drilldown after using transpose command?

Marco_Develops
Path Finder

After issuing a transpose command on my bar chart visualization I can't configure conditional drilldowns.

I tried using the untable command followed by the xyz series command and no luck.

this is the query:

 

search * 
| eval CATI = if(SEVCAT=="I", 1,0) 
| eval CATII = if(SEVCAT=="II", 1,0) 
| eval CATIII = if(SEVCAT=="III", 1,0) 
| chart sum(CATI) as I sum(CATII) as II sum(CATIII) as III
| transpose
| sort - "row 1"

 

 

The Drilldown XML :

 

<drilldown>
          <condition field = "I">
            <link target="blank"></link>
          </condition>
          <condition field = "II">
            <link target="blank"></link>
          </condition>
          <condition field = "III">
            <link target="blank"></link>
          </condition>
</drilldown>

 

 

Any help is appreciated.

Thank you, 
Marco

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

Marco_Develops
Path Finder

@ITWhisperer  Thank you!! Also,  great explanation.

-Marco

0 Karma

Gr0und_Z3r0
Contributor

Hi @Marco_Develops 

Try the following. Update your search this way..

your base search
|chart count over SEVCAT

 

And configure the dashboard panel drilldown to the following.

Gr0und_Z3r0_0-1650586299751.png


If it helps, karma points are appreciated!

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...