Dashboards & Visualizations

How to place a panel drilldown on top of another panel

kajolsharma
Path Finder

Hi,

I want to place a panel on top of existing panel on the click of a cell.

First screen:

kajolsharma_0-1627999406440.png

Second Screen:

kajolsharma_1-1627999436492.png

Is this feasible through Splunk?

 

 

Labels (4)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If you mean by 'on top of' = replacing the first panel with the second then yes, you can do it using tokens and depends attribute

Here's an example of how it works with two panels using depends/rejects and a token that is set/cleared on drilldown.

<dashboard>
  <label>Panels</label>
  <row>
    <panel rejects="$item$">
      <title>First Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="item">$row.item$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$item$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <unset token="item"></unset>
        </drilldown>
      </table>
    </panel>
    
  </row>
</dashboard>

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

If you mean by 'on top of' = replacing the first panel with the second then yes, you can do it using tokens and depends attribute

Here's an example of how it works with two panels using depends/rejects and a token that is set/cleared on drilldown.

<dashboard>
  <label>Panels</label>
  <row>
    <panel rejects="$item$">
      <title>First Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="item">$row.item$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$item$">
      <title>Second Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <unset token="item"></unset>
        </drilldown>
      </table>
    </panel>
    
  </row>
</dashboard>

kajolsharma
Path Finder

By on top I meant on top of existing panel ,both the panels should be visible but the second  one should not completely overlap first. If that's possible???

0 Karma

bowesmana
SplunkTrust
SplunkTrust

In Splunk _everything_ is possible 😁

The same technique of using tokens - but you don't need the reject= token part as that hides the top panel.

See this - there is a single <panel> element and inside that, there are two <table> elements - the second one uses depends= to only show it when you click in the top panel.

By only using a single panel with 2 tables, they will be displayed one above, one below.

Hope this helps

<dashboard>
  <label>Panels</label>
  <row>
    <panel>
      <title>First Panel</title>
      <table>
        <search>
          <query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="item">$row.item$</set>
        </drilldown>
      </table>
      <table depends="$item$">
        <title>Second Panel</title>
        <search>
          <query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>row
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <unset token="item"></unset>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...