Dashboards & Visualizations

Make One column of table as drill down

architkhanna
Path Finder

I have a Splunk table with three columns with headings.
I want to know how to add drill down/make one column only(first column) clickable and pass that value to all other panels.
Any help would be appreciated.

A B C
1 2 3
4 5 6

make column A as clickable only. user should be able to click only on 1 and 4 at a time and same shall be passed on the dashboard.

0 Karma

vnravikumar
Champion

Hi

Try this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <title></title>
        <search>
          <query>| makeresults 
| eval A=1, B=2, C=3 
| append 
    [| makeresults 
    | eval A=4, B=5, C=6]|table A B C</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown target="_blank">
          <condition field="A">
             <link>
             <![CDATA[
                    /app/search/drilldown?value=$click.value$
                 ]]>
           </link>
          </condition>
          <condition field="B">
          </condition>
          <condition field="C">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

architkhanna
Path Finder

with this,you are redirecting the url.
What is required here is ,On click the clickable value must got the other panels as input (which are in the same dashboard).

0 Karma

vnravikumar
Champion

Hi

Check this, drilldown value will available in value token

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <title>$value$</title>
        <search>
          <query>| makeresults 
| eval A=1, B=2, C=3 
| append 
    [| makeresults 
    | eval A=4, B=5, C=6]|table A B C</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition field="A">
             <set token="value">$click.value$</set>
          </condition>
          <condition field="B">
          </condition>
          <condition field="C">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...