Dashboards & Visualizations

How to drill down from a table into a chart within the same dashboard

shanksholla
Explorer

Hi
I have a table in my dashboard which displays total number of hits and the average response time for each operation.

index=gwlogs service=customer | stats count(operation_name) avg(transaction_time) by operation_name

A drill down for the table is present which provides the error code along with the count for the chosen operation. This appears in a new tab.



<![CDATA[/app/search/search?q=search index=gwlogs service=customer operation_name=$click.value$ | stats count by error_code&earliest=$earliest$&latest=$latest$]]>

Is it possible to have the drilled down chart appear below the initial table itself.

Thank you!

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Add a chart to the dashboard below the table, and include a $foo$ token for your value. Change your link tag within the drilldown to a set tag and set the token to $click.value$. Something like this:

...
  <drilldown>
    <set token="foo">$click.value$</set>
  </drilldown>
...
<chart>
  <searchString>index=gwlogs service=customer operation_name="$foo$" | ...</searchString
...
</chart>
...

http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/PanelreferenceforSimplifiedXML#set

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Add a chart to the dashboard below the table, and include a $foo$ token for your value. Change your link tag within the drilldown to a set tag and set the token to $click.value$. Something like this:

...
  <drilldown>
    <set token="foo">$click.value$</set>
  </drilldown>
...
<chart>
  <searchString>index=gwlogs service=customer operation_name="$foo$" | ...</searchString
...
</chart>
...

http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/PanelreferenceforSimplifiedXML#set

shanksholla
Explorer

This gave me what I wanted. Thank you!

0 Karma

nfilippi_splunk
Splunk Employee
Splunk Employee

Yes, use the depends and/or rejects attribute for your element


index=gwlogs service=customer operation_name="$foo$" | ... ...

More info here:
http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/Understandbasictableandchartdrilldownactions#C...

shanksholla
Explorer

Hi, thanks for your reply. This partially solves my problem. With this there is any empty chart before any row is clicked. Can I make the charts appear only after a row is clicked?

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...