It's kinda like a main table showing all options, when you click one, the second table shows more info about the selected row.
I followed the drilldown tutorials, but I think I might be missing something with my query as follows:
<dashboard>
<label>Test</label>
<row>
<table>
<searchString>index=main | table Channel</searchString>
<drilldown>
<link>
<![CDATA[
/app/multicanal/test?form.Channel=$row.Channel$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>
</table>
</row>
<searchTemplate>Channel=$Channel$ | head 100</searchTemplate>
<earliestTime>-30d</earliestTime>
<latestTime>-0d</latestTime>
<fieldset autoRun="true" submitButton="false">
<input token="Channel"/>
</fieldset>
<row>
<table>
<title>Teste</title>
<option name="count">50</option>
</table>
</row>
</dashboard>
Thanks In Advance!
@strive @somesoni2
I've found another way through, after burnin' down my brain LOL
I did this Simple XML snippet, seems working fine for me, it's updating the table correctly, now everything I need to find out is a way to Hide the text input from the drilldown and maybe hide the MORE INFO table until user selects a row at first table...
Check It Out 😄
<form>
<label>Test Drilldown Query</label>
<description/>
<row>
<table>
<searchString>index=main | table ChannelCode</searchString>
<drilldown>
<link>
<![CDATA[
/app/test/test?form.ChannelCode=$row.ChannelCode$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>
</table>
</row>
<searchTemplate>ChannelCode=$ChannelCode$ | stats count by ChannelCode</searchTemplate>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<fieldset autoRun="true" submitButton="false">
<input token="ChannelCode">
<label>Choosen Value</label>
</input>
</fieldset>
<row>
<table>
<title>More Info</title>
<searchString>index=main ChannelCode=$ChannelCode$ | timechart count by ChannelCode</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="count">10</option>
</table>
</row>
</form>
How can I hide table 2 ( more info ) until token $channel$ is passed thru drill down row click??
As of Splunk 6.1, we now fully support contextual drilldown (aka, in-page drilldown) from Simple XML (no javascript or css required). There are 2 basic concepts that go into enabling this function:
There is a description and example provided in the following docs page.
http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/Understandbasictableandchartdrilldownactions#C...
There is also a good example found in the Splunk Enterprise 6.x Examples app (http://apps.splunk.com/app/1603/)
Here is an example. Note that the form input is not required to enable this feature, and only present to show how token binding works within dashboards.
<form>
<label>In-Page Drilldown with Perma-linking</label>
<fieldset submitButton="false">
<!--
Create an input to store the drilldown value. It will be hidden using custom javascript when
the dashboard is loaded.
-->
<input type="text" token="sourcetype" searchWhenChanged="true" />
</fieldset>
<row>
<table id="master">
<title>Master</title>
<searchString>index=_internal | stats count by sourcetype</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
<!-- Set the type of of drilldown, since we will always consume the same field, use row-->
<option name="drilldown">row</option>
<drilldown>
<!-- Use set to specify the new token to be created.
Use any token from the page or from the click event to produce the value needed. -->
<set token="sourcetype">$row.sourcetype$</set>
<!-- If we also set the form.sourcetype the input will get updated too -->
<set token="form.sourcetype">$row.sourcetype$</set>
</drilldown>
</table>
</row>
<row>
<!-- depends is the way we tell the content to only show when the token has a value.
Hint: use comma separated values if the element requires more than one token. -->
<chart id="detail" depends="$sourcetype$">
<title>Detail: $sourcetype$</title>
<searchTemplate>index=_internal sourcetype=$sourcetype$ | timechart count</searchTemplate>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
</chart>
</row>
</form>
I tryed styling it withing an HTML tag, but for some reason, it was also losing the query itself...
Although I did like this:
I'm going to try your snippet, see if it works with the search as well...
<html>
<input token="ChannelCode" style="display:none">
<label>Choosen Value</label>
</input>
</html>
Try this
<form>
<label>Test Drilldown Query</label>
<description/>
<row>
<table>
<searchString>index=main | table ChannelCode</searchString>
<drilldown>
<link>
<![CDATA[
/app/test/test?form.ChannelCode=$row.ChannelCode$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>
</table>
</row>
<searchTemplate>ChannelCode=$ChannelCode$ | stats count by ChannelCode</searchTemplate>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<fieldset autoRun="true" submitButton="false">
<input token="ChannelCode" id="field1">
<label>Choosen Value</label>
</input>
<html>
<style>
.input#field1
{
display:none;
}
</style>
</html>
</fieldset>
<row>
<table>
<title>More Info</title>
<searchString>index=main ChannelCode=$ChannelCode$ | timechart count by ChannelCode</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="count">10</option>
</table>
</row>
</form>
I tryed styling it withing an HTML tag, but for some reason, it was also losing the query itself...
Although I did like this:
I'm going to try your snippet, see if it works with the search as well...
Does anyone knows if <input>
tag has a property to set like isVisible="false" ?
Not working here...
@strive @somesoni2
I've found another way through, after burnin' down my brain LOL
I did this Simple XML snippet, seems working fine for me, it's updating the table correctly, now everything I need to find out is a way to Hide the text input from the drilldown and maybe hide the MORE INFO table until user selects a row at first table...
Check It Out 😄
<form>
<label>Test Drilldown Query</label>
<description/>
<row>
<table>
<searchString>index=main | table ChannelCode</searchString>
<drilldown>
<link>
<![CDATA[
/app/test/test?form.ChannelCode=$row.ChannelCode$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>
</table>
</row>
<searchTemplate>ChannelCode=$ChannelCode$ | stats count by ChannelCode</searchTemplate>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<fieldset autoRun="true" submitButton="false">
<input token="ChannelCode">
<label>Choosen Value</label>
</input>
</fieldset>
<row>
<table>
<title>More Info</title>
<searchString>index=main ChannelCode=$ChannelCode$ | timechart count by ChannelCode</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="count">10</option>
</table>
</row>
</form>
Splunk 6.1
I'm not so good with JavaScript, is it possible with Simple XML?
What version of Splunk are you using?
I found the correct term for this... as googlin' aroun'... seems like it's called IN-PAGE-DRILLDOWN but my Example app doesn't have this and I can't install it because I'm not the server owner...
By the main this searchTemplate is just a test search, not acctually what I'm gonna use, the big problem is that, I'm not sure if the drilldown is passing the selected row's value to the $parameter$ token =//