Dashboards & Visualizations

Make One column of table as drill down

architkhanna
Path Finder

I have a Splunk table with three columns with headings.
I want to know how to add drill down/make one column only(first column) clickable and pass that value to all other panels.
Any help would be appreciated.

A B C
1 2 3
4 5 6

make column A as clickable only. user should be able to click only on 1 and 4 at a time and same shall be passed on the dashboard.

0 Karma

vnravikumar
Champion

Hi

Try this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <title></title>
        <search>
          <query>| makeresults 
| eval A=1, B=2, C=3 
| append 
    [| makeresults 
    | eval A=4, B=5, C=6]|table A B C</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown target="_blank">
          <condition field="A">
             <link>
             <![CDATA[
                    /app/search/drilldown?value=$click.value$
                 ]]>
           </link>
          </condition>
          <condition field="B">
          </condition>
          <condition field="C">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

architkhanna
Path Finder

with this,you are redirecting the url.
What is required here is ,On click the clickable value must got the other panels as input (which are in the same dashboard).

0 Karma

vnravikumar
Champion

Hi

Check this, drilldown value will available in value token

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <title>$value$</title>
        <search>
          <query>| makeresults 
| eval A=1, B=2, C=3 
| append 
    [| makeresults 
    | eval A=4, B=5, C=6]|table A B C</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition field="A">
             <set token="value">$click.value$</set>
          </condition>
          <condition field="B">
          </condition>
          <condition field="C">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...