Solved: Re: Is it possible to update a table with a drilld...

vtsguerrero · ‎08-01-2014

It's kinda like a main table showing all options, when you click one, the second table shows more info about the selected row.
I followed the drilldown tutorials, but I think I might be missing something with my query as follows:

<dashboard>
  <label>Test</label>
  <row>
    <table>
      <searchString>index=main | table Channel</searchString>
      <drilldown>
        <link>
   <![CDATA[
    /app/multicanal/test?form.Channel=$row.Channel$&earliest=$earliest$&latest=$latest$
            ]]>
        </link>
      </drilldown>
    </table>
  </row>
     <searchTemplate>Channel=$Channel$ | head 100</searchTemplate>
     <earliestTime>-30d</earliestTime>
     <latestTime>-0d</latestTime>
     <fieldset autoRun="true" submitButton="false">
       <input token="Channel"/>
     </fieldset>
     <row>
       <table>
        <title>Teste</title>
        <option name="count">50</option>
      </table>
     </row>
</dashboard>

Thanks In Advance!

vtsguerrero · ‎08-01-2014

@strive @somesoni2

I've found another way through, after burnin' down my brain LOL
I did this Simple XML snippet, seems working fine for me, it's updating the table correctly, now everything I need to find out is a way to Hide the text input from the drilldown and maybe hide the MORE INFO table until user selects a row at first table...
Check It Out 😄

<form>
  <label>Test Drilldown Query</label>
  <description/>
  <row>
    <table>
      <searchString>index=main | table ChannelCode</searchString>
      <drilldown>
        <link>
          <![CDATA[
    /app/test/test?form.ChannelCode=$row.ChannelCode$&earliest=$earliest$&latest=$latest$
            ]]>
        </link>
      </drilldown>
    </table>
  </row>
  <searchTemplate>ChannelCode=$ChannelCode$ | stats count by ChannelCode</searchTemplate>
  <earliestTime>$earliest$</earliestTime>
  <latestTime>$latest$</latestTime>
  <fieldset autoRun="true" submitButton="false">
    <input token="ChannelCode">
      <label>Choosen Value</label>
    </input>
  </fieldset>
  <row>
    <table>
      <title>More Info</title>
      <searchString>index=main ChannelCode=$ChannelCode$ | timechart count by ChannelCode</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <option name="wrap">true</option>
      <option name="rowNumbers">false</option>
      <option name="dataOverlayMode">none</option>
      <option name="drilldown">none</option>
      <option name="count">10</option>
    </table>
  </row>
</form>

View solution in original post

vtsguerrero · ‎08-04-2014

How can I hide table 2 ( more info ) until token $channel$ is passed thru drill down row click??

nfilippi_splunk · ‎08-04-2014

As of Splunk 6.1, we now fully support contextual drilldown (aka, in-page drilldown) from Simple XML (no javascript or css required). There are 2 basic concepts that go into enabling this function:

Configuring the user click event to set/unset tokens rather than link to another page
Enable elements on the page to react to that token change (either show or hide based on the token having a value)

There is a description and example provided in the following docs page.
http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/Understandbasictableandchartdrilldownactions#C...

There is also a good example found in the Splunk Enterprise 6.x Examples app (http://apps.splunk.com/app/1603/)

Here is an example. Note that the form input is not required to enable this feature, and only present to show how token binding works within dashboards.

<form>
    <label>In-Page Drilldown with Perma-linking</label>
    <fieldset submitButton="false">
        <!--
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
         -->
        <input type="text" token="sourcetype" searchWhenChanged="true" />
    </fieldset>
    <row>
        <table id="master">
            <title>Master</title>
            <searchString>index=_internal | stats count by sourcetype</searchString>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
            <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
            <option name="drilldown">row</option>
            <drilldown>
                <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
                <set token="sourcetype">$row.sourcetype$</set>
                <!-- If we also set the form.sourcetype the input will get updated too -->
                <set token="form.sourcetype">$row.sourcetype$</set>
            </drilldown>
        </table>
    </row>
    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <chart id="detail" depends="$sourcetype$">
            <title>Detail: $sourcetype$</title>
            <searchTemplate>index=_internal sourcetype=$sourcetype$ | timechart count</searchTemplate>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
        </chart>
    </row>
</form>

vtsguerrero · ‎08-01-2014

I tryed styling it withing an HTML tag, but for some reason, it was also losing the query itself...
Although I did like this:
I'm going to try your snippet, see if it works with the search as well...

<html>
<input token="ChannelCode" style="display:none">
<label>Choosen Value</label>
</input>
</html>

somesoni2 · ‎08-01-2014

Try this

    <form>
      <label>Test Drilldown Query</label>
      <description/>
      <row>
        <table>
          <searchString>index=main | table ChannelCode</searchString>
          <drilldown>
            <link>
              <![CDATA[
        /app/test/test?form.ChannelCode=$row.ChannelCode$&earliest=$earliest$&latest=$latest$
                ]]>
            </link>
          </drilldown>
        </table>
      </row>
      <searchTemplate>ChannelCode=$ChannelCode$ | stats count by ChannelCode</searchTemplate>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <fieldset autoRun="true" submitButton="false">
        <input token="ChannelCode" id="field1">
          <label>Choosen Value</label>
        </input>
    <html>
<style>
.input#field1
{
display:none;
}
</style>
     </html>
      </fieldset>
      <row>
        <table>
          <title>More Info</title>
          <searchString>index=main ChannelCode=$ChannelCode$ | timechart count by ChannelCode</searchString>
          <earliestTime>$earliest$</earliestTime>
          <latestTime>$latest$</latestTime>
          <option name="wrap">true</option>
          <option name="rowNumbers">false</option>
          <option name="dataOverlayMode">none</option>
          <option name="drilldown">none</option>
          <option name="count">10</option>
        </table>
      </row>
    </form>

vtsguerrero · ‎08-01-2014

I tryed styling it withing an HTML tag, but for some reason, it was also losing the query itself...
Although I did like this:
I'm going to try your snippet, see if it works with the search as well...

Choosen Value

vtsguerrero · ‎08-01-2014

Does anyone knows if <input> tag has a property to set like isVisible="false" ?
Not working here...

vtsguerrero · ‎08-01-2014

@strive @somesoni2

I've found another way through, after burnin' down my brain LOL
I did this Simple XML snippet, seems working fine for me, it's updating the table correctly, now everything I need to find out is a way to Hide the text input from the drilldown and maybe hide the MORE INFO table until user selects a row at first table...
Check It Out 😄

<form>
  <label>Test Drilldown Query</label>
  <description/>
  <row>
    <table>
      <searchString>index=main | table ChannelCode</searchString>
      <drilldown>
        <link>
          <![CDATA[
    /app/test/test?form.ChannelCode=$row.ChannelCode$&earliest=$earliest$&latest=$latest$
            ]]>
        </link>
      </drilldown>
    </table>
  </row>
  <searchTemplate>ChannelCode=$ChannelCode$ | stats count by ChannelCode</searchTemplate>
  <earliestTime>$earliest$</earliestTime>
  <latestTime>$latest$</latestTime>
  <fieldset autoRun="true" submitButton="false">
    <input token="ChannelCode">
      <label>Choosen Value</label>
    </input>
  </fieldset>
  <row>
    <table>
      <title>More Info</title>
      <searchString>index=main ChannelCode=$ChannelCode$ | timechart count by ChannelCode</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <option name="wrap">true</option>
      <option name="rowNumbers">false</option>
      <option name="dataOverlayMode">none</option>
      <option name="drilldown">none</option>
      <option name="count">10</option>
    </table>
  </row>
</form>

strive · ‎08-01-2014

See this

http://answers.splunk.com/answers/113562/same-page-drilldown-splunk-6-simple-xml

vtsguerrero · ‎08-01-2014

Splunk 6.1

I'm not so good with JavaScript, is it possible with Simple XML?

somesoni2 · ‎08-01-2014

What version of Splunk are you using?

vtsguerrero · ‎08-01-2014

I found the correct term for this... as googlin' aroun'... seems like it's called IN-PAGE-DRILLDOWN but my Example app doesn't have this and I can't install it because I'm not the server owner...

vtsguerrero · ‎08-01-2014

By the main this searchTemplate is just a test search, not acctually what I'm gonna use, the big problem is that, I'm not sure if the drilldown is passing the selected row's value to the $parameter$ token =//

Is it possible to update a table with a drilldown value from another table's field in the same browser tab?

Routing logs with Splunk OTel Collector for Kubernetes

Welcome to the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM