Dashboards & Visualizations

How to create a dynamic drilldown from chart's legend to populate a new dashboard?

frederick_lefeb
New Member

[I edited this question to reflect further investigation I did]
I created a dashboard that contains a series of timecharts from pivots. I'm trying to create a dynamic drilldown to send user to another dashboard with they click on a specific field.

Following the documentation, I added a marker inside a section on my dashboard like so:

<panel>
      <chart>
        <title>Data transfered by System - Consortia : $consortia$</title>
        <searchString>| pivot globus MyData sum(TB) AS "TB transfered" FILTER CONSORTIUM is $site$ SPLITROW _time AS _time PERIOD day SPLITCOL SYSTEM_NAME SORT 0 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 25 SHOWOTHER 1</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisY2.enabled">false</option>
        ....
        <drilldown target="DrillDown test">
          <link>
             globus_usage_per_system?form.system=$click.value$
           </link>
        </drilldown> 
      </chart>
</panel>

The link works but $click.value$ is not replaced and so, in the resulting URL, I get '$click.value$' instead of the actual value. I later noticed that if I click inside the graph, it seems to work. My issue is I want to click on the chart's legend to populate a new dashboard from the legend entry that was clicked. Is that possible ?

0 Karma

ngatchasandra
Builder

during tests of your process , i received always error due to name of view that concern a alphanumeric caracters, please if you can specify all your code precisely, this will help me exactly. I try to do your process like this, but it return the results drildown in the same dashboard:

<row>
        <chart id="master">
            <title>Master</title>
            <searchString>...........field</searchString>
            <earliestTime></earliestTime>
            <latestTime></latestTime>

            <option name="drilldown">bar</option>
            <drilldown>

                <set token="field">$bar.field$</set>
                <!-- If we also set the form.sourcetype the input will get updated too -->
                <set token="form.field">$bar.field$</set>
            </drilldown>
        </chart>
    </row>
    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <chart id="detail" depends="$field$">
            <title>Detail: $field$</title>
            <searchTemplate>index=.... field=$field$ | timechart count</searchTemplate>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
        </chart>
    </row>
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...