How to display the details of the panel using drilldown

[aditsss]

Hi Everyone,

I have one query like this which is showing the count of the Failed jobs in a single value like shown below:

<panel>
<title>Count of Jobs Failed</title>
<single>
<search>
<query>index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"| eval fields=split(_raw,",") |eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|eval JOB_STATUS=mvindex(fields,5)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|eval Run_Date=strptime(RunDate,"%Y%m%d")
|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|where JOB_STATUS=="FAILED"|stats COUNT</query>
<earliest>-2d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</single>

I am getting the single value as 2 which are the Failed Job

I want when I should Click on 2 it should show me the details of the two failed Jobs.

I have tried like this but not working. Can someone guide me on this:

<panel depends="$show_panel$">
<table>
<title>Failed RID Details</title>
<search>
<query>index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"| eval fields=split(_raw,",") |eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|eval JOB_STATUS=mvindex(fields,5)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|eval Run_Date=strptime(RunDate,"%Y%m%d")
|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|where JOB_STATUS=="FAILED" $selected_value$
</query>
<earliest>-2d@d</earliest>
<latest>now</latest>
</search>
<option name="count">100</option>
</table>
</panel>

Can someone guide me on this.

[ITWhisperer]

What are you expecting $selected_value$ to do to the where clause? Since the table search is identical to the single search apart from the count, the table will already have the results you are looking for, and setting the show_panel token will allow them to be displayed.

[aditsss]

@ITWhisperer 

I want to show the details of the failed job.On clicking of the count.Like on clicking on 2 it should show the details of failed jobs

[ITWhisperer]

Doesn't the search in the table already deliver the details you want (without the $selected_value$ part)?

[aditsss]

@ITWhisperer 

No its not working.

[Marco]

<drilldown>
    <condition field="Failed Jobs">
       <link target = "_blank">search?q=index%3Dabc%20source%3D%22%2FsplunkLogs%2FJOB_MDJX_CS_STATS_PLATINUM.csv%22%7C%20eval%20fields%3Dsplit(_raw%2C%22%2C%22)%20%7Ceval%20Environment%3Dmvindex(fields%2C11)%7Ceval%20JOBFLOW_ID%3Dmvindex(fields%2C0)%20%7Ceval%20JOB_EXEC_TIME%3Dmvindex(fields%2C8)%7Ceval%20RunDate%3Dmvindex(fields%2C3)%7Ceval%20JOB_STATUS%3Dmvindex(fields%2C5)%7Cwhere%20Environment%3D%22E3%22%7Cwhere%20JOBFLOW_ID%20LIKE%20%22%25%25%22%7Ceval%20RunDate%3D%2220%22.mvindex(fields%2C3)%7Ceval%20Run_Date%3Dstrptime(RunDate%2C%22%25Y%25m%25d%22)%0A%7Cfieldformat%20Run_Date%3Dstrftime(Run_Date%2C%22%25d%2F%25b%2F%25Y%22)%7Cwhere%20JOB_STATUS%3D%3D%22FAILED%22%7Cstats%20COUNT</link>



</drilldown>

This is what my code looks like when I want to drilldown to a detailed search.  

You have the token selected_value , in the conditions field you can change "Failed Jobs"  to what you are expecting  .  

Also very important, you have to put your query inside a url encoder: https://meyerweb.com/eric/tools/dencoder/ <--- This one works good.

-Marco

[kamlesh_vaghela · Accepted solution]

@aditsss 

Can you please take this sample XML?

<dashboard>
  <label>Sample</label>
  <row>
    <panel>
      <single>
        <search>
          <query>| makeresults count=10 | eval c=1 | accum c | eval A=case((c%3)==0,"Hi",1=1,"Hello") | where A="Hi" | stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="show_me">A</set>
          <set token="flag_to_execute_search">Hi</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$show_me$">
      <table>
        <search>
          <query>| makeresults count=10 | eval c=1 | accum c | eval A=case((c%3)==0,"Hi",1=1,"Hello") | where A="$flag_to_execute_search$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.