Dashboards & Visualizations

How to get different drill down for different values within one dashboard?

YuliyaVassilyev
Explorer

I have a dashboard with few values withing three panels. What i am trying to accomplish is to make sure with the click of each value within a panel, I can see the drill down of those values. For now, when i click on different values I get the same drill down. Thank you in advance!
Here is some of XML:

<option name="drilldown">all</option>
    <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
    <option name="refresh.display">progressbar</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trellis.enabled">1</option>
    <option name="trellis.size">medium</option>
    <drilldown>
      <set token="status">$trellis.value$</set>
      <set token="show_panel">true</set>
      <unset token="show_panel2"></unset>
      <unset token="show_panel3"></unset>
      <set token="event_type">Epics</set>
      <set token="label">Status</set>
0 Karma

spavin
Path Finder

Hi @YuliyaVassilyeva,

To get different values, you can use <condition>...</condition>

If you have 3 known split-by names, then you can show/hide the panels by selectively setting and unsetting tokens that the panels depend upon.

EG, if your split by fields were APLPHA, BETA, and GAMMA, then this will show the ALPHA panel when you click on ALPHA, and hide the other panels.

<drilldown>
          <condition match="$trellis.value$=&quot;ALPHA&quot;">
            <set token="show_panel1">true</set>
            <unset token="show_panel2"></unset>
            <unset token="show_panel3"></unset>
            <set token="event_type">Epics</set>
            <set token="label">Status</set>
          </condition>
          <condition match="$trellis.value$=&quot;BETA&quot;">
            <set token="show_panel2">true</set>
            <unset token="show_panel1"></unset>
            <unset token="show_panel3"></unset>
            <set token="event_type">Epics</set>
            <set token="label">Status</set>
          </condition>
          <condition match="$trellis.value$=&quot;GAMMA&quot;">
            <set token="show_panel3">true</set>
            <unset token="show_panel2"></unset>
            <unset token="show_panel1"></unset>
            <set token="event_type">Epics</set>
            <set token="label">Status</set>
          </condition>
          <condition>
           <unset token="show_panel2"></unset>
            <unset token="show_panel1"></unset>
            <unset token="show_panel3"></unset>
            <unset token="event_type"></unset>
            <unset token="label"></unset>
          </condition>
        </drilldown>

Then have your panels set up:

<row>
<panel depends="$show_panel1$">...</panel>
<panel depends="$show_panel2$">...</panel>
<panel depends="$show_panel3$">...</panel>
</row>

Cheers,
Daniel

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...