Dashboards & Visualizations

How to create a dynamic drilldown from chart's legend to populate a new dashboard?

frederick_lefeb
New Member

[I edited this question to reflect further investigation I did]
I created a dashboard that contains a series of timecharts from pivots. I'm trying to create a dynamic drilldown to send user to another dashboard with they click on a specific field.

Following the documentation, I added a marker inside a section on my dashboard like so:

<panel>
      <chart>
        <title>Data transfered by System - Consortia : $consortia$</title>
        <searchString>| pivot globus MyData sum(TB) AS "TB transfered" FILTER CONSORTIUM is $site$ SPLITROW _time AS _time PERIOD day SPLITCOL SYSTEM_NAME SORT 0 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 25 SHOWOTHER 1</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisY2.enabled">false</option>
        ....
        <drilldown target="DrillDown test">
          <link>
             globus_usage_per_system?form.system=$click.value$
           </link>
        </drilldown> 
      </chart>
</panel>

The link works but $click.value$ is not replaced and so, in the resulting URL, I get '$click.value$' instead of the actual value. I later noticed that if I click inside the graph, it seems to work. My issue is I want to click on the chart's legend to populate a new dashboard from the legend entry that was clicked. Is that possible ?

0 Karma

ngatchasandra
Builder

during tests of your process , i received always error due to name of view that concern a alphanumeric caracters, please if you can specify all your code precisely, this will help me exactly. I try to do your process like this, but it return the results drildown in the same dashboard:

<row>
        <chart id="master">
            <title>Master</title>
            <searchString>...........field</searchString>
            <earliestTime></earliestTime>
            <latestTime></latestTime>

            <option name="drilldown">bar</option>
            <drilldown>

                <set token="field">$bar.field$</set>
                <!-- If we also set the form.sourcetype the input will get updated too -->
                <set token="form.field">$bar.field$</set>
            </drilldown>
        </chart>
    </row>
    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <chart id="detail" depends="$field$">
            <title>Detail: $field$</title>
            <searchTemplate>index=.... field=$field$ | timechart count</searchTemplate>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
        </chart>
    </row>
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...