Dashboards & Visualizations

How to place a panel drilldown on top of another panel

kajolsharma
Path Finder

Hi,

I want to place a panel on top of existing panel on the click of a cell.

First screen:

kajolsharma_0-1627999406440.png

Second Screen:

kajolsharma_1-1627999436492.png

Is this feasible through Splunk?

 

 

Labels (4)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If you mean by 'on top of' = replacing the first panel with the second then yes, you can do it using tokens and depends attribute

Here's an example of how it works with two panels using depends/rejects and a token that is set/cleared on drilldown.

<dashboard>
  <label>Panels</label>
  <row>
    <panel rejects="$item$">
      <title>First Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="item">$row.item$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$item$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <unset token="item"></unset>
        </drilldown>
      </table>
    </panel>
    
  </row>
</dashboard>

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

If you mean by 'on top of' = replacing the first panel with the second then yes, you can do it using tokens and depends attribute

Here's an example of how it works with two panels using depends/rejects and a token that is set/cleared on drilldown.

<dashboard>
  <label>Panels</label>
  <row>
    <panel rejects="$item$">
      <title>First Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="item">$row.item$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$item$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <unset token="item"></unset>
        </drilldown>
      </table>
    </panel>
    
  </row>
</dashboard>

kajolsharma
Path Finder

By on top I meant on top of existing panel ,both the panels should be visible but the second  one should not completely overlap first. If that's possible???

0 Karma

bowesmana
SplunkTrust
SplunkTrust

In Splunk _everything_ is possible 😁

The same technique of using tokens - but you don't need the reject= token part as that hides the top panel.

See this - there is a single <panel> element and inside that, there are two <table> elements - the second one uses depends= to only show it when you click in the top panel.

By only using a single panel with 2 tables, they will be displayed one above, one below.

Hope this helps

<dashboard>
  <label>Panels</label>
  <row>
    <panel>
      <title>First Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="item">$row.item$</set>
        </drilldown>
      </table>
      <table depends="$item$">
        <title>Second Panel</title>
        <search>
          <query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <unset token="item"></unset>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...