Solved: Need help to fix trellis drilldown

uagraw01 · ‎08-12-2025

Hello Splunkers!!

I want to configure the dashboard so that when I click GTP, only cells 8 and 9 are displayed in the second panel, with all other cells hidden. Similarly, clicking North or South should display only their respective cells. Please guide me on how to achieve this by adjusting the Trellis drilldown settings in the dashboard.

Below is the expectation I want.

In a statistical view below:

My current trellis token is looking as below :

Thanks in advance.

bowesmana · ‎08-13-2025

Arh, my mistake, I did not change all the tokens, see this line

<set token="cluster_name">$trellis.value$</set>

change it to

<set token="tokCluster">$trellis.value$</set>

View solution in original post

bowesmana · ‎08-12-2025

You can do it like this example - I have simulated your data - the final panel is the filtered one.

Hope this helps

<form version="1.1" theme="light">
  <label>Demo2</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="cluster" searchWhenChanged="true">
      <label>Cluster</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>cluster</fieldForLabel>
      <fieldForValue>cluster</fieldForValue>
      <search base="data">
        <query>| stats count by cluster</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search id="data">
          <query>| makeresults | fields - _time
| eval data=split("GTP:2:8,North:7:10,South:7:1", ",")
| mvexpand data
| rex field=data "(?&lt;cluster&gt;\w+):(?&lt;num&gt;\d+):(?&lt;start&gt;\d+)"
| eval cell=mvrange(start, start+num, 1)
| fields cluster cell
| mvexpand cell
| stats count by cluster cell</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
      <single>
        <search base="data">
          <query>
            | stats count by cluster
          </query>
        </search>
        <option name="drilldown">all</option>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">medium</option>
        <option name="useColors">1</option>
        <drilldown>
          <set token="cluster">$trellis.value$</set>
          <set token="form.cluster">$trellis.value$</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <single>
        <title>Showing cells for cluster $cluster$</title>
        <search base="data">
          <query>
          | search cluster=$cluster$
          | stats sum(count) as count by cell
          </query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0xf1813f","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">small</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</form>

uagraw01 · ‎08-13-2025

@bowesmana Thanks for all the suggestion. While applying in my real code. I am still facing an issue. As I provided my code below please help me to fix it.

<row>
<panel>
<single>
<title>Depalletising, Decanting Faults per thousand cases ( Overall )</title>
<search>
<query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate>0 AND operational_rate>0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
search index=internal_statistics_1h earliest=-30d latest=now
[ | inputlookup internal_statistics
| where report="Throughput" AND level="step" AND measurement="Case"
AND (step="Defoil and decanting" OR step="Defoil and depalletising")
| fields id | rename id AS statistic_id ]
| eval value=coalesce(value, sum_value)
| stats sum(value) AS dda_count
| return $dda_count
]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
| chart count(Faults) as Faults</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0.0</option>
<option name="rangeColors">["0x53a051","0xf8be34","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="trellis.size">large</option>
<option name="useColors">1</option>
<drilldown>
<set token="cluster">$trellis.value$</set>
<set token="form.cluster">$trellis.value$</set>
</drilldown>
</single>
<single >
<title>Depalletising, Decanting Faults per thousand cases ( Cluster )</title>
<search>
<query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate>0 AND operational_rate>0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
search index=internal_statistics_1h earliest=-30d latest=now
[ | inputlookup internal_statistics
| where report="Throughput" AND level="step" AND measurement="Case"
AND (step="Defoil and decanting" OR step="Defoil and depalletising")
| fields id | rename id AS statistic_id ]
| eval value=coalesce(value, sum_value)
| stats sum(value) AS dda_count
| return $dda_count
]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
| chart count(Faults) as Faults BY cluster</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[0,30,100]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="trellis.size">medium</option>
<option name="trellis.splitBy">cluster</option>
<option name="useColors">1</option>

<drilldown>
<set token="cluster">$trellis.value$</set>
<set token="form.cluster">$trellis.value$</set>
</drilldown>
</single>
</panel>
<panel>
<single >
<title>Depalletising, Decanting Faults per thousand cases ( Per Cell )</title>
<search>
<query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate>0 AND operational_rate>0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
search index=internal_statistics_1h earliest=-30d latest=now
[ | inputlookup internal_statistics
| where report="Throughput" AND level="step" AND measurement="Case"
AND (step="Defoil and decanting" OR step="Defoil and depalletising")
| fields id | rename id AS statistic_id ]
| eval value=coalesce(value, sum_value)
| stats sum(value) AS dda_count
| return $dda_count
]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
| chart count(Faults) as Faults BY cell</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0xf1813f","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[1,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="trellis.size">small</option>
<option name="useColors">1</option>
</single>
</panel>
</row>

ITWhisperer · ‎08-13-2025

Try this:

<init>
<set token="cluster"></set>
</init>

<row>
<panel>
<single>
<title>Depalletising, Decanting Faults per thousand cases ( Overall )</title>
<search>
<query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate&gt;0 AND operational_rate&gt;0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
search index=internal_statistics_1h earliest=-30d latest=now
[ | inputlookup internal_statistics
| where report="Throughput" AND level="step" AND measurement="Case"
AND (step="Defoil and decanting" OR step="Defoil and depalletising")
| fields id | rename id AS statistic_id ]
| eval value=coalesce(value, sum_value)
| stats sum(value) AS dda_count
| return $dda_count
]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
| chart count(Faults) as Faults</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0.0</option>
<option name="rangeColors">["0x53a051","0xf8be34","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="trellis.size">large</option>
<option name="useColors">1</option>
<drilldown>
<set token="cluster">$trellis.value$</set>
<set token="form.cluster">$trellis.value$</set>
</drilldown>
</single>
<single >
<title>Depalletising, Decanting Faults per thousand cases ( Cluster )</title>
<search>
<query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate&gt;0 AND operational_rate&gt;0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
search index=internal_statistics_1h earliest=-30d latest=now
[ | inputlookup internal_statistics
| where report="Throughput" AND level="step" AND measurement="Case"
AND (step="Defoil and decanting" OR step="Defoil and depalletising")
| fields id | rename id AS statistic_id ]
| eval value=coalesce(value, sum_value)
| stats sum(value) AS dda_count
| return $dda_count
]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
| chart count(Faults) as Faults BY cluster</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[0,30,100]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="trellis.size">medium</option>
<option name="trellis.splitBy">cluster</option>
<option name="useColors">1</option>
<!-- Click a cluster tile -->
<drilldown>
<eval token="cluster">"| where cluster=\"".$trellis.value$."\""</eval>
</drilldown>
</single>
</panel>
<panel>
<single >
<title>Depalletising, Decanting Faults per thousand cases ( Per Cell )</title>
<search>
<query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
$cluster$
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate&gt;0 AND operational_rate&gt;0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
search index=internal_statistics_1h earliest=-30d latest=now
[ | inputlookup internal_statistics
| where report="Throughput" AND level="step" AND measurement="Case"
AND (step="Defoil and decanting" OR step="Defoil and depalletising")
| fields id | rename id AS statistic_id ]
| eval value=coalesce(value, sum_value)
| stats sum(value) AS dda_count
| return $dda_count
]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
| chart count(Faults) as Faults BY cell</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0xf1813f","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[1,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="trellis.size">small</option>
<option name="useColors">1</option>
<drilldown>
<set token="cluster"></set>
<set token="form.cluster"></set>
</drilldown>
</single>
</panel>
</row>

uagraw01 · ‎08-13-2025

Hi @ITWhisperer
Thanks for working on this.

While loading the dashboard at very first all the panels are loading including Overall, cluster and cells.

I want to load Overall ( first) then click ---> load Clusters panel --> then click any cluster open only its respective cells and its count.

One more issue I can see. While clicking back the panel one, I can se third panel is showing error with lookup.

ITWhisperer · ‎08-13-2025

You are moving the goal posts again. Please provide your full dashboard source as you have it now so we might determine where the fault lies.

Are you saying that you want the second and third panels to be visible but not filtered?

uagraw01 · ‎08-13-2025

Hi @ITWhisperer

Below is my complete code.

<form stylesheet="common:vanderlande.css, customer_reports=mordc.css" theme="dark">
  <label>Daily Performance Dashboard ( Services )</label>
  <init>
    <!-- Ensure details are hidden until user clicks the first panel -->
    <unset token="tokShowDetails"></unset>
  </init>
  <fieldset submitButton="true">
    <input type="time" token="time" searchWhenChanged="false">
      <label>Time Selector</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Depalletising, Decanting Faults per thousand cases ( Overall )</title>
        <search>
          <query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate&gt;0 AND operational_rate&gt;0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
    search index=internal_statistics_1h earliest=-30d latest=now
      [ | inputlookup internal_statistics
        | where report="Throughput" AND level="step" AND measurement="Case"
              AND (step="Defoil and decanting" OR step="Defoil and depalletising")
        | fields id | rename id AS statistic_id ]
    | eval value=coalesce(value, sum_value)
    | stats sum(value) AS dda_count
    | return $dda_count
  ]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
| chart count(Faults) as Faults</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">large</option>
        <option name="useColors">1</option>
        <drilldown>
          <set token="tokShowCluster">1</set>
          <unset token="tokShowCells"></unset>
          <unset token="tokCluster"></unset>
        </drilldown>
      </single>
      <single depends="$tokShowCluster$">
        <title>Depalletising, Decanting Faults per thousand cases ( Cluster )</title>
        <search>
          <query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate&gt;0 AND operational_rate&gt;0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
    search index=internal_statistics_1h earliest=-30d latest=now
      [ | inputlookup internal_statistics
        | where report="Throughput" AND level="step" AND measurement="Case"
              AND (step="Defoil and decanting" OR step="Defoil and depalletising")
        | fields id | rename id AS statistic_id ]
    | eval value=coalesce(value, sum_value)
    | stats sum(value) AS dda_count
    | return $dda_count
  ]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
| chart count(Faults) as Faults BY cluster</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">medium</option>
        <option name="trellis.splitBy">cluster</option>
        <option name="useColors">1</option>
        <!-- Click a cluster tile -->
        <drilldown>
          <set token="tokShowCells">1</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <single depends="$tokShowCells$">
        <title>Depalletising, Decanting Faults per thousand cases ( Per Cell )</title>
        <search>
          <query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate&gt;0 AND operational_rate&gt;0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
    search index=internal_statistics_1h earliest=-30d latest=now
      [ | inputlookup internal_statistics
        | where report="Throughput" AND level="step" AND measurement="Case"
              AND (step="Defoil and decanting" OR step="Defoil and depalletising")
        | fields id | rename id AS statistic_id ]
    | eval value=coalesce(value, sum_value)
    | stats sum(value) AS dda_count
    | return $dda_count
  ]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
| chart count(Faults) as Faults BY cell</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xf1813f","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[1,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">small</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</form>

bowesmana · ‎08-13-2025

@uagraw01 your dashboard code is odd - you don't have a version="1.1" in the <form> element and you have a time picker that is not used because you are hard coding the earliest and latest times in the search.

Also, your search is the same in all 3 panels, apart from the final line, so I have moved that out to a single hidden search that is a base search and it is used by all of the 3 panels searches.

So, if I understand correctly, you click on the first Faults counter and it closes panel 3 and opens panel 2 where you see the count by cluster - if you click on a cluster it opens panel 3 and shows the cluster details for the clicked cluster name.

I have updated your search to do the drilldown based on that.

If you want panel 3 to show when you first click the total Faults box, then remove this from the first panel drilldown.

<unset token="tokShowCells"></unset>

(BTW: is that count(Faults) as Faults correct - should it be sum(Faults)?)

<form version="1.1" stylesheet="common:vanderlande.css, customer_reports=mordc.css" theme="dark">
  <label>Daily Performance Dashboard ( Services )</label>
  <init>
    <!-- Ensure details are hidden until user clicks the first panel -->
    <unset token="tokShowDetails"></unset>
    <set token="tokCluster">*</set>
  </init>
  <fieldset submitButton="true">
    <input type="time" token="time" searchWhenChanged="false">
      <label>Time Selector</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table depends="$hidden$">
        <search id="base_data_search">
          <query>(index=si_error source=scada (error_status=CAME_IN OR error_status=WENT_OUT) (_time=Null OR NOT virtual)) earliest=-30d latest=now
| fields area zone equipment isc_id error error_status start_time
| eval _time=coalesce(start_time, _time)
| search error_status=CAME_IN
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| lookup new_ctcl_21_07.csv JoinedAttempt1 AS statistical_subject mis_address AS error OUTPUTNEW description operational_rate technical_rate alarm_severity
| lookup internal_cell_cluster.csv isc_id AS isc_id OUTPUTNEW cell cluster
| lookup mordc_Av_full_assets.csv Area AS area Zone AS zone Section AS equipment OUTPUT TopoID
| lookup mordc_topo ID AS TopoID OUTPUT Description AS Area
| where Area="Depalletizing, Decanting" AND technical_rate&gt;0 AND operational_rate&gt;0 AND isnotnull(alarm_severity) AND isnotnull(mark_code)
| dedup isc_id error _time
| stats count AS scada_count BY cell cluster
| eval dda_count = [
    search index=internal_statistics_1h earliest=-30d latest=now
      [ | inputlookup internal_statistics
        | where report="Throughput" AND level="step" AND measurement="Case"
              AND (step="Defoil and decanting" OR step="Defoil and depalletising")
        | fields id | rename id AS statistic_id ]
    | eval value=coalesce(value, sum_value)
    | stats sum(value) AS dda_count
    | return $dda_count
  ]
| eval Faults = (scada_count/dda_count)*1000
| table cell cluster Faults
| sort cell cluster
          </query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
      </table>
      <single>
        <title>Depalletising, Decanting Faults per thousand cases ( Overall )</title>
        <search base="base_data_search">
          <query>| chart count(Faults) as Faults</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">large</option>
        <option name="useColors">1</option>
        <drilldown>
          <set token="tokShowCluster">1</set>
          <unset token="tokShowCells"></unset>
          <set token="tokCluster">*</set>
        </drilldown>
      </single>
      <single depends="$tokShowCluster$">
        <title>Depalletising, Decanting Faults per thousand cases ( Cluster )</title>
        <search base="base_data_search">
          <query>| chart count(Faults) as Faults BY cluster</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">medium</option>
        <option name="trellis.splitBy">cluster</option>
        <option name="useColors">1</option>
        <!-- Click a cluster tile -->
        <drilldown>
          <set token="tokShowCells">1</set>
          <set token="tokCluster">$trellis.value$</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <single depends="$tokShowCells$">
        <title>Depalletising, Decanting Faults per thousand cases ( Per Cell )</title>
        <search base="base_data_search">
          <query>
            | search cluster=$tokCluster|s$
            | chart count(Faults) as Faults BY cell</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xf1813f","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[1,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">small</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</form>

uagraw01 · ‎08-13-2025

Hi @bowesmana,

Thank you for your response. The only difference I have observed is that when I click on the second panel, it displays all results. I would like it so that when I click on “GTP,” it should display only the corresponding GTP values (e.g., 8 and 9). Could you please advise on how I can associate this filter with the second panel?

bowesmana · ‎08-13-2025

See this statement in the 3rd panel search

| search cluster=$tokCluster|s$

it does the filtering and the token setting will set that to the clicked cluster - I will edit the original XML in my post

bowesmana · ‎08-13-2025

Arh, my mistake, I did not change all the tokens, see this line

<set token="cluster_name">$trellis.value$</set>

change it to

<set token="tokCluster">$trellis.value$</set>

Need help to fix trellis drilldown

other

single value

trellis layout

CX Day is Coming!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Are you a member of the Splunk Community?