Dashboards & Visualizations

How to drill down from a table into a chart within the same dashboard

shanksholla
Explorer

Hi
I have a table in my dashboard which displays total number of hits and the average response time for each operation.

index=gwlogs service=customer | stats count(operation_name) avg(transaction_time) by operation_name

A drill down for the table is present which provides the error code along with the count for the chosen operation. This appears in a new tab.



<![CDATA[/app/search/search?q=search index=gwlogs service=customer operation_name=$click.value$ | stats count by error_code&earliest=$earliest$&latest=$latest$]]>

Is it possible to have the drilled down chart appear below the initial table itself.

Thank you!

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Add a chart to the dashboard below the table, and include a $foo$ token for your value. Change your link tag within the drilldown to a set tag and set the token to $click.value$. Something like this:

...
  <drilldown>
    <set token="foo">$click.value$</set>
  </drilldown>
...
<chart>
  <searchString>index=gwlogs service=customer operation_name="$foo$" | ...</searchString
...
</chart>
...

http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/PanelreferenceforSimplifiedXML#set

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Add a chart to the dashboard below the table, and include a $foo$ token for your value. Change your link tag within the drilldown to a set tag and set the token to $click.value$. Something like this:

...
  <drilldown>
    <set token="foo">$click.value$</set>
  </drilldown>
...
<chart>
  <searchString>index=gwlogs service=customer operation_name="$foo$" | ...</searchString
...
</chart>
...

http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/PanelreferenceforSimplifiedXML#set

View solution in original post

shanksholla
Explorer

This gave me what I wanted. Thank you!

0 Karma

nfilippi_splunk
Splunk Employee
Splunk Employee

Yes, use the depends and/or rejects attribute for your element


index=gwlogs service=customer operation_name="$foo$" | ... ...

More info here:
http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/Understandbasictableandchartdrilldownactions#C...

shanksholla
Explorer

Hi, thanks for your reply. This partially solves my problem. With this there is any empty chart before any row is clicked. Can I make the charts appear only after a row is clicked?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.