I have a chart which is team over location.
Eg - chart count as Resources by Team, Location|addcoltotals|addtotals (used appendpipe instead of addcoltotals as well)
Label - US, AUS, UK
Team 1
Team 2
Team 3
I am trying to do a custom drilldown to show all team members in that location when selecting the total row.
The drilldown I have works fine if you select anything other than the addcoltotals and/or addtotals values.
The issue I am having is changing the “null” to a *
and the Total to a *
to put in the drilldown search.
It works if I rename the labels for the total columns and rows to *
(but would like it to say total for the users) but using eval to make a variable hold *
if it's null works, BUT passing this variable into the search for the drilldown doesn’t work.
Dilldown search I have:
(big long search string) |search Team = $TeamTok$ "Location" = $LocationTok$
Drilldown search I would like
(big long search string)| eval Search1 = if ($TeamTok$ = “null” ,”*”,$TeamTok$)|search Team = "Search1" "Location" = $LocationTok$
Here is an example of this
<dashboard>
<label>Test Answers</label>
<row>
<panel>
<chart>
<search>
<query>eventtype=splunkd-log | eval x="a" | chart count over x by log_level | addtotals</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<condition field="Total">
<set token="t">*</set>
</condition>
<condition field="*">
<set token="t">$click.name2$</set>
</condition>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<title>Selection: $t$</title>
<search>
<query>eventtype=splunkd-log log_level=$t$ | table _time log_level</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="list.drilldown">none</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">none</option>
<option name="rowNumbers">false</option>
<option name="table.drilldown">all</option>
<option name="table.wrap">1</option>
<option name="type">table</option>
<option name="wrap">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</dashboard>
Here is an example of this
<dashboard>
<label>Test Answers</label>
<row>
<panel>
<chart>
<search>
<query>eventtype=splunkd-log | eval x="a" | chart count over x by log_level | addtotals</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<condition field="Total">
<set token="t">*</set>
</condition>
<condition field="*">
<set token="t">$click.name2$</set>
</condition>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<title>Selection: $t$</title>
<search>
<query>eventtype=splunkd-log log_level=$t$ | table _time log_level</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="list.drilldown">none</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">none</option>
<option name="rowNumbers">false</option>
<option name="table.drilldown">all</option>
<option name="table.wrap">1</option>
<option name="type">table</option>
<option name="wrap">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</dashboard>
this works for the row totals but not the column totals.
I tired the below for the columns (rename the total for columns to have a space at the end)
<drilldown>
<condition field="Total">
<set token="t">*</set>
<set token="TeamTok">$row.MasterTeam$</set>
<set token="showDetails">true</set>
</condition>
<condition field="*">
<set token="t">$click.name2$</set>
<set token="TeamTok">$row.MasterTeam$</set>
<set token="showDetails">true</set>
</condition>
<condition field="Total ">
<set token="t">$click.name2$</set>
<set token="TeamTok">*</set>
<set token="showDetails">true</set>
</condition>
</drilldown>
what should happen when col total is clicked?
seeing it has addcoltotal and addtotal
I want if people select the far right column it will get back all of the locations for that team
if they select the bottom most row I want it to return all the teams for that location (the chart is team by location)
with your help it does the right most column action
You should be able to achive this by using conditional tokens
. Here's some documentation on the topic
Thanks sundareshr
I looked into the link and tried it but I could not get it to work for me
I tried something like
<set token="TeamTok">$row.MasterTeam$</set>
<condition TeamTok="null">
<set token="TeamTok">'*'</set>
</condition>
<set token="GeoTok">$click.name2$</set>
<set token="showDetails">true</set>
</drilldown>
seeing I want to capture what the user selected just change the token to equal * when the current token is "null" or "Total"