How to pass multiple values from a drilldown in a table to a separate dashboard?

[Wiggy]

Say I have a dashboard with a panel that generates a table of values and I want to be able to drill down on several values of the row when I click on one of the values within that row. How do you go about this using simple xml, and could I get an example?

[algalvan]

Is there a way to pass multiple values on the same dashboard?

[sumeetsirohi1]

@algalvan Did you find a way to do this on the same dashboard?

[Wiggy · Accepted solution]

You have to use the drilldown element as linked here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...

With the link value, you specify the separate view that you want the drilldown values to get passed to and then list out the values separated by "&".

The following two xml examples show how to set up drilldown options in one view, and how to accept them in the second view. This first view (we will call the dashboard "test1" will generate a table of values sourcetype, component, name and count. When you click on a value in the table, the sourcetype, component and name of that row will be sent to the second dashboard (we will call test2).

Dashboard xml for "test1" which has the drilldown table:

<dashboard>
  <label>test1</label>
  <description/>
  <row>
    <panel>
      <table>
        <title>Test for drilldown case</title>
        <searchString>index=_internal | stats count by sourcetype, component, name</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <drilldown>
          <link>
            <![CDATA[
              /app/search/test2?form.sourcetype=$row.sourcetype$&form.component=$row.component$&form.name=$row.name$
            ]]>
          </link>
        </drilldown>  
      </table>
    </panel>
  </row>
</dashboard>

Dashboard xml for "test2" which accepts the drilldown values passed from "test1" dashboard:

<dashboard>
  <label>test2</label>
  <description/>
  <row>
    <panel>
      <event>
        <title>drill down panel</title>
        <searchString>index=_internal sourcetype=$form.sourcetype$ component=$form.component$ name=$form.name$</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">0</option>
        <option name="dataOverlayMode">none</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</dashboard>

You will notice that the values get passed via the url and the search in the "test2" dashboard panel is populated with the values passed from the row clicked on in "test1".

[anwarmian]

Wiggy, very nice example!!!!!!! I would have given you extra points but we are not allowed to.