Dashboards & Visualizations

How to place a panel drilldown on top of another panel

kajolsharma
Path Finder

Hi,

I want to place a panel on top of existing panel on the click of a cell.

First screen:

kajolsharma_0-1627999406440.png

Second Screen:

kajolsharma_1-1627999436492.png

Is this feasible through Splunk?

 

 

Labels (4)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If you mean by 'on top of' = replacing the first panel with the second then yes, you can do it using tokens and depends attribute

Here's an example of how it works with two panels using depends/rejects and a token that is set/cleared on drilldown.

<dashboard>
  <label>Panels</label>
  <row>
    <panel rejects="$item$">
      <title>First Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="item">$row.item$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$item$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <unset token="item"></unset>
        </drilldown>
      </table>
    </panel>
    
  </row>
</dashboard>

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

If you mean by 'on top of' = replacing the first panel with the second then yes, you can do it using tokens and depends attribute

Here's an example of how it works with two panels using depends/rejects and a token that is set/cleared on drilldown.

<dashboard>
  <label>Panels</label>
  <row>
    <panel rejects="$item$">
      <title>First Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="item">$row.item$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$item$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <unset token="item"></unset>
        </drilldown>
      </table>
    </panel>
    
  </row>
</dashboard>

kajolsharma
Path Finder

By on top I meant on top of existing panel ,both the panels should be visible but the second  one should not completely overlap first. If that's possible???

0 Karma

bowesmana
SplunkTrust
SplunkTrust

In Splunk _everything_ is possible :beaming_face_with_smiling_eyes:

The same technique of using tokens - but you don't need the reject= token part as that hides the top panel.

See this - there is a single <panel> element and inside that, there are two <table> elements - the second one uses depends= to only show it when you click in the top panel.

By only using a single panel with 2 tables, they will be displayed one above, one below.

Hope this helps

<dashboard>
  <label>Panels</label>
  <row>
    <panel>
      <title>First Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="item">$row.item$</set>
        </drilldown>
      </table>
      <table depends="$item$">
        <title>Second Panel</title>
        <search>
          <query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <unset token="item"></unset>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...