Dashboards & Visualizations

How to create a drilldown to display a specific data log in a panel based on the selected value in a table in the same dashboard?

ssingh313
Path Finder

I wanted to open data logs on the same dashboard as my table, so if you click on a attribute on the table, it would display that specific data log below. I created an "events" panel and drilldown to the events panel, but right now it's opening all the data logs associated with the table together and I want it such that the logs are only displayed when a specific attribute is clicked on. Anyone know how I can fix this problem?

0 Karma

jeffland
SplunkTrust
SplunkTrust

You need to set tokens based on what the user has clicked. See here for docs, you will need something like this in your table where the user is supposed to click for drilldown:

<table>
  <search>...
  </search
  <option ...>
  <drilldown>
    <set token="drilldown_attribute">$click.name2$</set>
  </drilldown>
</table>

In the table (or events panel or chart, it's the same for all visualizations) showing only messages from the given attribute, you need something like this:

<table>
  <search>
    <query>source=foo attribute="$drilldown_attribute$" | table ... </query>
  </search
  <option ...>
</table>

Refer to the docs for more info on click.name2 and other options.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...