Since linkSearch, linkFields, and linkSearch are deprecated, how can I control the drilldown of a single value visualization?

[guilmxm]

Hi!

According to the documentation, following options in single forms are now deprecated and shall not be used anymore: (while this still works, support may be removed in the future, and this is a failure for app certification check)

• linkSearch
• linkFields
• linkSearch

For reference:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/PanelreferenceforSimplifiedXML#single

Ok, I guess this is related with Splunk 6.3.x single value improvements (cool!) that provides native options such as open in search, like in charts. (this was not the case febore)

But the story does not tell how the drilldown can be controlled now... the only drilldown related and non deprecated option is the drilldown activation:

drilldown (all | none) none all:
Drilldown enabled. none: Drilldown
disabled. This option applies to the
element to implement
dynamic drilldown for single values.

Do not enable this option if you are
implementing drilldown using the
following options to the
element:

linkFields linkSearch linkView

Which will only activate the drilldown of the single value visualization, clicking on it will open in search the associated search.

Is there a way "non deprecated" to control the drilldown feature? (What search will be run, where, token re-used...)

Isn't it a loss of functionality ! Not an improvement... why putting these options deprecated without providing options with at least the same level of functionality?

A simple example to illustrate, let's say you have a single value associated with a search that will repors the number of relevant errors for your context, you want to provide to the user the drilldown feature a search that will show these errors... not how to count it which has no interest for the user... of course the user can modify the search itself, but this is not the idea behind user interface...

Maybe I missed something ?

Thank you in advance !

Cheers,

[somesoni2 · Accepted solution]

The drilldown will be enabled by the option "drilldown" and it's behavior can be defined as any other table/chart visualization, by usieng <drilldown><link> tag.

Something like this

 <single>
        <search>
          <query>index=_internal | stats count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>                       ****drilldown enabledment*****
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <drilldown>                                                      ***drilldown action***
          <link>/app/simple_xml_examples/custom_layout_dark</link>
        </drilldown>
      </single>

[guilmxm]

That's great, and it does indeed improve single forms as it is now normalized like others forms, a major improvement 🙂

But, that's just my opinion, the doc is not clear enough and does not mention this explicitly, i guess at least it is confusing for people that we used to work with single forms before this...

Anyway, this is the answer i was expecting, perfect, thank you !