Dashboards & Visualizations

Since linkSearch, linkFields, and linkSearch are deprecated, how can I control the drilldown of a single value visualization?

guilmxm
SplunkTrust
SplunkTrust

Hi!

According to the documentation, following options in single forms are now deprecated and shall not be used anymore: (while this still works, support may be removed in the future, and this is a failure for app certification check)

  • linkSearch
  • linkFields
  • linkSearch

For reference:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/PanelreferenceforSimplifiedXML#single

Ok, I guess this is related with Splunk 6.3.x single value improvements (cool!) that provides native options such as open in search, like in charts. (this was not the case febore)

But the story does not tell how the drilldown can be controlled now... the only drilldown related and non deprecated option is the drilldown activation:

drilldown (all | none) none all:
Drilldown enabled. none: Drilldown
disabled. This option applies to the
element to implement
dynamic drilldown for single values.

Do not enable this option if you are
implementing drilldown using the
following options to the
element:

linkFields linkSearch linkView

Which will only activate the drilldown of the single value visualization, clicking on it will open in search the associated search.

Is there a way "non deprecated" to control the drilldown feature? (What search will be run, where, token re-used...)

Isn't it a loss of functionality ! Not an improvement... why putting these options deprecated without providing options with at least the same level of functionality?

A simple example to illustrate, let's say you have a single value associated with a search that will repors the number of relevant errors for your context, you want to provide to the user the drilldown feature a search that will show these errors... not how to count it which has no interest for the user... of course the user can modify the search itself, but this is not the idea behind user interface...

Maybe I missed something ?

Thank you in advance !

Cheers,

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The drilldown will be enabled by the option "drilldown" and it's behavior can be defined as any other table/chart visualization, by usieng <drilldown><link> tag.

Something like this

 <single>
        <search>
          <query>index=_internal | stats count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>                       ****drilldown enabledment*****
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <drilldown>                                                      ***drilldown action***
          <link>/app/simple_xml_examples/custom_layout_dark</link>
        </drilldown>
      </single>

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The drilldown will be enabled by the option "drilldown" and it's behavior can be defined as any other table/chart visualization, by usieng <drilldown><link> tag.

Something like this

 <single>
        <search>
          <query>index=_internal | stats count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>                       ****drilldown enabledment*****
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <drilldown>                                                      ***drilldown action***
          <link>/app/simple_xml_examples/custom_layout_dark</link>
        </drilldown>
      </single>

guilmxm
SplunkTrust
SplunkTrust

That's great, and it does indeed improve single forms as it is now normalized like others forms, a major improvement 🙂

But, that's just my opinion, the doc is not clear enough and does not mention this explicitly, i guess at least it is confusing for people that we used to work with single forms before this...

Anyway, this is the answer i was expecting, perfect, thank you !

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...