Dashboards & Visualizations
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

How to stop drilldown value being passed before search is finished?

cblanton
Communicator
‎08-16-2019 12:20 PM

Hi,

I have a table that is calculating a value for "totaljobs". The drilldown passes that value as a token to the next panel, but if the first panel is clicked on before the search finishes it passes the count at that moment and not the correct value that would be passed once the search has finished. Clicking on the same line after the search is finished updates the token value to the correct value, but users don't know that they are getting an incorrect value when clicking "early."

In drill down of first panel:

<set token="CounterJ">$row.totaljobs</set>

In title of second panel:

<title>Failed Jobs: $CounterF$ Total Jobs: $CounterJ$</title>

The other token, $CounterF$, isn't an issue because it's a count of the results that loads with the panel.

How do I prevent the drilldown from passing the value until after the search is complete and the value is correct?

0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

niketn
Legend
‎08-16-2019 04:28 PM

@cblanton for panel 1 display the chart only after the search has completed (using a token to set inside the panel search's <done> search event handler) so that drilldown has the latest/most current value.

Following is a run anywhere example which shows the panel only after its underlying search completes (using <done> search evenet handler).

<dashboard>
  <label>Drilldown only after search completes</label>
  <row>
    <panel depends="$tokPanelSearchCompleted$">
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd
| top log_level showcount=f showperc=t
| table log_level percent</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokPanelSearchCompleted">true</set>
          </done>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="tokDrilldownPercent">$row.percent$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        tokDrilldownPercent: $tokDrilldownPercent$
      </html>
    </panel>
  </row>
</dashboard>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

niketn
Legend
‎08-16-2019 04:28 PM

@cblanton for panel 1 display the chart only after the search has completed (using a token to set inside the panel search's <done> search event handler) so that drilldown has the latest/most current value.

Following is a run anywhere example which shows the panel only after its underlying search completes (using <done> search evenet handler).

<dashboard>
  <label>Drilldown only after search completes</label>
  <row>
    <panel depends="$tokPanelSearchCompleted$">
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd
| top log_level showcount=f showperc=t
| table log_level percent</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="tokPanelSearchCompleted">true</set>
          </done>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="tokDrilldownPercent">$row.percent$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        tokDrilldownPercent: $tokDrilldownPercent$
      </html>
    </panel>
  </row>
</dashboard>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply
Solved! Jump to solution

woodcock
Esteemed Legend
‎08-16-2019 01:04 PM

There is no way to do exactly what you desire but the best way to address the situation is to speed up your searches so that they finish very quickly. There are many ways to do this including using base searches, tstats, report acceleration, accelerated data models, summary index, metrics index, and loadjob.

Reply
Solved! Jump to solution

cblanton
Communicator
‎08-19-2019 10:57 AM

Thanks! This was very helpful to not continue trying to do the impossible. The table is a form with inputs so I've struggled to find a way to speed it up with these options.

0 Karma
Reply
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...