How to drill down a single value panel from dashboard?

[SapthagiriAavik]

i have many single value panels in a dashboard,So When i click a panel it should open with same search string in a new tab. i tried with custom drill down ,but its opening a empty new tab. kindly guide me

[niketn]

@SapthagiriAavikov, following is a run anywhere dashboard based on Splunk's _internal index to show the options to run the search in a new window for Single Value Trellis Layout as well as Single Value without Trellis.

<form>
  <label>Trellis single value drilldown</label>
  <fieldset submitButton="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO earliest=-24h@h latest=now
| stats count by component</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trellis.splitBy">component</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
        <drilldown>
          <link target="_blank">search?q=index="_internal" sourcetype="splunkd" log_level!="INFO" component="$trellis.value$"
| stats count by component&amp;earliest=$field1.earliest$&amp;latest=$field1.latest$</link>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <title>$tokClickName$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO earliest=-24h@h latest=now
| stats count by component 
| sort - count 
| head 1
| table count component</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
        <drilldown>
          <condition match="$row.component$=&quot;TimeoutHeap&quot;">
            <set token="tokClickName">$row.component$</set>
            <link target="_blank">search?q=index=_internal sourcetype=splunkd log_level!=INFO
  | stats count by component 
  | sort - count 
  | search count="$click.value$" AND component="$row.component$"&amp;earliest=$field1.earliest$&amp;latest=$field1.latest$</link>
          </condition>
          <condition>
            <!-- DO NOTHING-->
            <set token="tokClickName">$row.component$</set>
          </condition>
        </drilldown>
      </single>
    </panel>
  </row>
</form>

Please try out and confirm!

[niketn]

@SapthagiriAavikov, are you using Trellis for multiple Single Value panels or does each Single Value panel have its own query?

[tiagofbmm]

Hey follow this example and edit the source of the dashboard:

<dashboard>
  <label>Test1</label>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_internal | head 10 | where source like "%" | stats count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</dashboard>