Dashboards & Visualizations

How to get different drill down for different values within one dashboard?

YuliyaVassilyev
Explorer

I have a dashboard with few values withing three panels. What i am trying to accomplish is to make sure with the click of each value within a panel, I can see the drill down of those values. For now, when i click on different values I get the same drill down. Thank you in advance!
Here is some of XML:

<option name="drilldown">all</option>
    <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
    <option name="refresh.display">progressbar</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trellis.enabled">1</option>
    <option name="trellis.size">medium</option>
    <drilldown>
      <set token="status">$trellis.value$</set>
      <set token="show_panel">true</set>
      <unset token="show_panel2"></unset>
      <unset token="show_panel3"></unset>
      <set token="event_type">Epics</set>
      <set token="label">Status</set>
0 Karma

spavin
Path Finder

Hi @YuliyaVassilyeva,

To get different values, you can use <condition>...</condition>

If you have 3 known split-by names, then you can show/hide the panels by selectively setting and unsetting tokens that the panels depend upon.

EG, if your split by fields were APLPHA, BETA, and GAMMA, then this will show the ALPHA panel when you click on ALPHA, and hide the other panels.

<drilldown>
          <condition match="$trellis.value$=&quot;ALPHA&quot;">
            <set token="show_panel1">true</set>
            <unset token="show_panel2"></unset>
            <unset token="show_panel3"></unset>
            <set token="event_type">Epics</set>
            <set token="label">Status</set>
          </condition>
          <condition match="$trellis.value$=&quot;BETA&quot;">
            <set token="show_panel2">true</set>
            <unset token="show_panel1"></unset>
            <unset token="show_panel3"></unset>
            <set token="event_type">Epics</set>
            <set token="label">Status</set>
          </condition>
          <condition match="$trellis.value$=&quot;GAMMA&quot;">
            <set token="show_panel3">true</set>
            <unset token="show_panel2"></unset>
            <unset token="show_panel1"></unset>
            <set token="event_type">Epics</set>
            <set token="label">Status</set>
          </condition>
          <condition>
           <unset token="show_panel2"></unset>
            <unset token="show_panel1"></unset>
            <unset token="show_panel3"></unset>
            <unset token="event_type"></unset>
            <unset token="label"></unset>
          </condition>
        </drilldown>

Then have your panels set up:

<row>
<panel depends="$show_panel1$">...</panel>
<panel depends="$show_panel2$">...</panel>
<panel depends="$show_panel3$">...</panel>
</row>

Cheers,
Daniel

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...