How to drop down selected table field data into a sub-panel?

[rbardonetorian]

Hello Splunksters,

I would like to select a row in my table and have it open a new panel under the originating panel with another output table only using the selected row criteria. How could I make this happen?

Currently, I see posts about dynamic -drill downs sending to template pages external pages, etc. I also see drill-down updating chart criteria in the docs and "answers" posts.. nothing helps me with my use case, using the tables.

Here is the originating panel code I am working with:

    <panel>
      <title>Activity</title>
      <table>
        <title>Activity</title>
        <search>
          <query>index="main" eventtype="special" NOT tag::eventtype=noise |  sort - _time|  table _time src_ip user name field</query>
          <earliest>$field3.earliest$</earliest>
          <latest>$field3.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">preview</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">false</option>
      </table>
    </panel>

I would like the "destination" "drop-down" panel to output to the same format table, simply with data comprised of the originating selection.

Thanks much for the help!!

(Simple XML is throwing me for a loop) 😉

[somesoni2 · Accepted solution]

I believe what you need (based on your text before dashboard code in the question) is a contextual drilldown dashboard, examples of which can be found in this link.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Understandbasictableandchartdrilldownactions#C...

The text after the dashboard code in your question says "drop-down" which is confusing. Is it dropdown or drilldown??

[rbardonetorian]

Thanks much! I believe that does help me. I cant believe I missed that..

Any pointers on setting the panel to a specific height ? ie 300 pixels?

Cheers!

[somesoni2]

See this

https://answers.splunk.com/answers/223644/how-to-limit-panel-height.html

Search for keywork "height" here for more info.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#Panel_visualiza...

[rbardonetorian]

Rock on!!!!! Thx!

[rbardonetorian]

I ran into a snag.. I am trying to send the contextual data to an "event panel". All the reference docs refer to "charting".
I am trying to set the following with no joy.

<event depends="$type_tok$">... serarch XML.. </event>

any ideas?

[somesoni2]

It should work the same way it works for charts or any other visualization. Just check that syntax of event visualization is written correctly. See this
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#event