Solved: Re: How to stop drilldown value being passed befor...

cblanton · ‎08-16-2019

Hi,

I have a table that is calculating a value for "totaljobs". The drilldown passes that value as a token to the next panel, but if the first panel is clicked on before the search finishes it passes the count at that moment and not the correct value that would be passed once the search has finished. Clicking on the same line after the search is finished updates the token value to the correct value, but users don't know that they are getting an incorrect value when clicking "early."

In drill down of first panel:

<set token="CounterJ">$row.totaljobs</set>

In title of second panel:

<title>Failed Jobs: $CounterF$ Total Jobs: $CounterJ$</title>

The other token, $CounterF$, isn't an issue because it's a count of the results that loads with the panel.

How do I prevent the drilldown from passing the value until after the search is complete and the value is correct?

niketn · ‎08-16-2019

@cblanton for panel 1 display the chart only after the search has completed (using a token to set inside the panel search's <done> search event handler) so that drilldown has the latest/most current value.

Following is a run anywhere example which shows the panel only after its underlying search completes (using <done> search evenet handler).

<dashboard>
  <label>Drilldown only after search completes</label>
  <row>
    <panel depends="$tokPanelSearchCompleted$">
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd
| top log_level showcount=f showperc=t
| table log_level percent</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokPanelSearchCompleted">true</set>
          </done>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="tokDrilldownPercent">$row.percent$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        tokDrilldownPercent: $tokDrilldownPercent$
      </html>
    </panel>
  </row>
</dashboard>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn · ‎08-16-2019

@cblanton for panel 1 display the chart only after the search has completed (using a token to set inside the panel search's <done> search event handler) so that drilldown has the latest/most current value.

Following is a run anywhere example which shows the panel only after its underlying search completes (using <done> search evenet handler).

<dashboard>
  <label>Drilldown only after search completes</label>
  <row>
    <panel depends="$tokPanelSearchCompleted$">
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd
| top log_level showcount=f showperc=t
| table log_level percent</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokPanelSearchCompleted">true</set>
          </done>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="tokDrilldownPercent">$row.percent$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        tokDrilldownPercent: $tokDrilldownPercent$
      </html>
    </panel>
  </row>
</dashboard>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

woodcock · ‎08-16-2019

There is no way to do exactly what you desire but the best way to address the situation is to speed up your searches so that they finish very quickly. There are many ways to do this including using base searches, tstats, report acceleration, accelerated data models, summary index, metrics index, and loadjob.

cblanton · ‎08-19-2019

Thanks! This was very helpful to not continue trying to do the impossible. The table is a form with inputs so I've struggled to find a way to speed it up with these options.

How to stop drilldown value being passed before search is finished?

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?