How to get my custom drilldown search to run when selecting the Total row on a chart?

[michaelmcneil]

I have a chart which is team over location.

Eg - chart count as Resources by Team, Location|addcoltotals|addtotals (used appendpipe instead of addcoltotals as well)

Label - US, AUS, UK
Team 1
Team 2
Team 3

I am trying to do a custom drilldown to show all team members in that location when selecting the total row.
The drilldown I have works fine if you select anything other than the addcoltotals and/or addtotals values.
The issue I am having is changing the “null” to a * and the Total to a * to put in the drilldown search.
It works if I rename the labels for the total columns and rows to * (but would like it to say total for the users) but using eval to make a variable hold * if it's null works, BUT passing this variable into the search for the drilldown doesn’t work.

Dilldown search I have:

(big long search string) |search Team = $TeamTok$  "Location" = $LocationTok$

Drilldown search I would like

(big long search string)| eval Search1 = if ($TeamTok$ = “null” ,”*”,$TeamTok$)|search Team = "Search1" "Location" = $LocationTok$

[sundareshr · Accepted solution]

Here is an example of this

<dashboard>
  <label>Test Answers</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>eventtype=splunkd-log | eval x="a" | chart count over x by log_level | addtotals</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <condition field="Total">
            <set token="t">*</set>
          </condition>
          <condition field="*">
            <set token="t">$click.name2$</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Selection: $t$</title>
        <search>
          <query>eventtype=splunkd-log log_level=$t$ | table _time log_level</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">none</option>
        <option name="rowNumbers">false</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">table</option>
        <option name="wrap">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</dashboard>

[michaelmcneil]

this works for the row totals but not the column totals.
I tired the below for the columns (rename the total for columns to have a space at the end)

   <drilldown>
              <condition field="Total">
                <set token="t">*</set>
                <set token="TeamTok">$row.MasterTeam$</set>
                <set token="showDetails">true</set>
               </condition>
               <condition field="*">
                 <set token="t">$click.name2$</set>
                 <set token="TeamTok">$row.MasterTeam$</set>
                 <set token="showDetails">true</set>
               </condition>
                  <condition field="Total ">
                <set token="t">$click.name2$</set>
                <set token="TeamTok">*</set>
                <set token="showDetails">true</set>
               </condition>

            </drilldown>

[sundareshr]

what should happen when col total is clicked?

[michaelmcneil]

seeing it has addcoltotal and addtotal
I want if people select the far right column it will get back all of the locations for that team
if they select the bottom most row I want it to return all the teams for that location (the chart is team by location)
with your help it does the right most column action

[sundareshr]

You should be able to achive this by using conditional tokens. Here's some documentation on the topic

http://docs.splunk.com/Documentation/Splunk/6.2.8/Viz/tokens#Define_tokens_for_conditional_operation...

[michaelmcneil]

Thanks sundareshr
I looked into the link and tried it but I could not get it to work for me

I tried something like

      <set token="TeamTok">$row.MasterTeam$</set>
      <condition TeamTok="null">
      <set token="TeamTok">'*'</set>
      </condition>
      <set token="GeoTok">$click.name2$</set>
      <set token="showDetails">true</set>
    </drilldown>

seeing I want to capture what the user selected just change the token to equal * when the current token is "null" or "Total"