Dashboards & Visualizations

Is it possible to create a dynamic drilldown on specific values in the column of a dashboard panel, not just the column?

nivedita_viswan
Path Finder

I have a dashboard panel that has a column, "signatures" with the top 10 values for it. When clicked on the 1st value, I want to go to a dashboard that shows more detailed information. On clicking the 2nd value, I want to go to a different dashboard. The 2 dashboards have panels that execute completely different queries. On clicking the 3rd value, I want to go to the raw logs, as is the case without dynamic drill-down. Is such a dynamic drill-down, based on values in the column (and not just the column name), possible? Any help would be appreciated.

vinodmadaan
Path Finder

HI Nivedita,

I was working on the similar thing and was facing the same problem, I found out an alternative solution for it and it solved my purpose (might be of use for you as well).

So here it goes:
In my case I had few browser and then I had to create a drill down so that when I click on browser I get into the dashboard that shows the stats for its version, so every bar in the dashboard was suppose to link to the other dashboard containing version specific to the browser. Just like this:
https://www.dropbox.com/s/e7cfanss17l77pv/MainDashboard.PNG?dl=0

Here is the thing that I did:
I created a dashboard (I will call it as main dashboard) that showed me all the browser info one that is in the attached link (like IE, Chrome etc), then I created another dashboard with the name starting with Browser name that was in the main dashboard (for eg. IE_versions, that contains all the version stats for the IE, So when I click on IE bar in main dashboard it should come here).

Point to note here is that when you create the dashboard in the Dashboard ID please start the id name with same letters as bar value and in same case (like in my case I set the Id to be IE_version_count).

Here is what the version dashboard looks like:
https://www.dropbox.com/s/an93dbl9oykxt17/IE_version_count.PNG?dl=0

Here is the main part:
In the XML add the following line:

<drilldown>          
            <link><![CDATA[/app/search/**$click.value$**_version_count?earliest=0&latest=]]></link>           
</drilldown>

The click.value will take the value of the bar and place in the URL which takes it to the desired dashboard (like for chrome it will take me to Chrome_version_count and so on)

The disadvantage is that you have to follow the name every time you create a new dashboard (but I guess that is not that a big problem).

(I have tried my best to explain but if there is anything unclear please ask in the comments and I will try my best to solve it)

Vinod.

0 Karma

pedromvieira
Communicator

Yes it is possible.
You have to define each field to drill-down.
Also you can link to a new search as well.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/Dynamicdrilldownindashboardsandforms

PS: Multiple fields can be implemented.

Example:

<row>
    <panel>
        <chart>
        ...
            <drilldown>
                <link field="field">/app/YOUR_APP/YOUR_VIEW?form.YOUR_FORM=$click.value2$</link>
                <link field="field" target="YOUR_WINDOW">/app/YOUR_APP/YOUR_VIEW?form.YOUR_FORM=$click.value2$</link>
                <link field="field" target="YOUR_WINDOW"><![CDATA[/app/YOUR_APP/YOUR_VIEW?form.YOUR_FORM_1=$click.value2$&form.YOUR_FORM_2=$YOUR_TOKEN$]]></link>               
            </drilldown>
            <option name="drilldown">cell</option>
        ...
        </chart>
    </panel>
</row>  

nivedita_viswan
Path Finder

I have something very similar in place. But it seems like I always end up going to the drilled-down view, irrespective of which row I click. Should the field="field" be the column reference? or the row value reference?

0 Karma

pedromvieira
Communicator

The drilldown behavior token defines which value you pass to.

http://docs.splunk.com/Documentation/Splunk/latest/Viz/Understandbasictableandchartdrilldownactions

Token   Description
click.name  Name of the leftmost field that is displayed in the table. This is always _time, if present.
click.value Value of the left-most column in the clicked row.
click.name2 Name of the clicked column.
click.value2    Value of the clicked column.
row.<fieldname> All field values for the clicked table row, including those fields that are not displayed.
earliest/latest Time range of the clicked table row, or if not applicable, the time range of the search.
0 Karma

nivedita_viswan
Path Finder

I may not have composed my question correctly. I am able to pass the correct value to the drilled-down form.

I have a table with 2 columns and 4 rows.
I only want to pass the clicked value when i click on a particular cell (say, only the cell in the 3rd row and 1st column) of my table. When I click on any other cell (say, cell in the 1st/2nd/4th row and 1st column and any cell in the 2nd column) of this table, I don't want to be taken to the drilled-down dashboard. Instead, I would like to be taken to the logs (which would be the default behavior, in the absence of a drill-down stanza in the source XML).

Would such a configuration be possible?

0 Karma

adityapavan18
Contributor

Hey Niveditha..any luck with this??

0 Karma

nivedita_viswan
Path Finder

click.value2 does give me the value in the cell clicked. But i wasnt able to selectively drill down to the raw logs.

0 Karma

avilandau
Path Finder

I was looking for the exact feature. Did you fin a way to do this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...