Why am I receiving error for Drilldown between 2 panels on the same dashboard?

[POR160893]

Hi,

I have a dashboard where I have a panel and ONLY if the user clicks on a row of this panel, does another panel pops up on the same same dashboard. The field that connects both panels is "SESSION_UUID". The drilldown feature is not currently working though.

Here is my XML code:

<form theme="dark" script="tokenlist.js">
<row>
<panel>

<table>
<search>
<query>
index=fraud_glassbox sourcetype="gb:sessions"
| table SESSION_UUID Global_MCMID_CSH SESSION_TIMESTAMP COUNTRY CITY CLIENT_IP Global_EmailID_CSH
</query>
</search>
<option name="drilldown">cell</option>
<drilldown>
<set token="tokComponent">$row.component$</set>
</drilldown>
</table>
</panel>
</row>

<row depends="$tokComponent$">
<panel>

<table>
<search>
<query>
index=fraud_glassbox sourcetype="gb:hit" component="$tokComponent$
| table HEADER_REQUEST_REFERER,URL_PATH, SESSION_TIMESTAMP, username,CLIENT_IP, PACKET_IP
</query>
</search>
</table>
</panel>
</row>
</form>

Can you please help as at the moment I am receiving the following error and the 2nd dashboard should not be appearing anyway unless the user clicks on a row in the 1st panel:

Thanks,
Patrick

[VatsalJagani]

You forgot quote here:

component="$tokComponent$
| table H

change to

component="$tokComponent$"
| table H

[ITWhisperer]

<set token="tokComponent">$row.component$</set>

component isn't one of the fields in the table

index=fraud_glassbox sourcetype="gb:hit" component="$tokComponent$"

needs closing quotes (as the error message suggests)

[POR160893]

I closed the quotes but which table do I need to add $row.component$ to?

[ITWhisperer]

The drilldown should reference a field from the table being displayed in the panel

| table SESSION_UUID Global_MCMID_CSH SESSION_TIMESTAMP COUNTRY CITY CLIENT_IP Global_EmailID_CSH

For example,

$row.SESSION_UUID$

[VatsalJagani]

Here

<table>
<search>
<query>
index=fraud_glassbox sourcetype="gb:sessions"
| table SESSION_UUID Global_MCMID_CSH SESSION_TIMESTAMP COUNTRY CITY CLIENT_IP Global_EmailID_CSH
</query>
</search>
<option name="drilldown">cell</option>
<drilldown>
<set token="tokComponent">$row.component$</set>
</drilldown>
</table>

You are trying to access row.component field. but if you look at the query it will never generate the component field as the table command will not output the component field.

[POR160893]

The following does not produce any results for the 2nd panel:

<form theme="dark" script="tokenlist.js">
<label>Fraud Investigations Test - POR</label>
<description> This dashboard ....</description>

<row>
<panel>

<table>
<search>
<query>
index=fraud_glassbox sourcetype="gb:sessions"
| table SESSION_UUID Global_MCMID_CSH SESSION_TIMESTAMP COUNTRY CITY CLIENT_IP Global_EmailID_CSH
</query>
</search>
<option name="drilldown">cell</option>
<drilldown>
<set token="tokComponent">$row.component$</set>
</drilldown>
</table>
</panel>
</row>

<row depends="$tokComponent$">
<panel>

<table>
<search>
<query>
index=fraud_glassbox sourcetype="gb:hit" component="$tokComponent$"
| table HEADER_REQUEST_REFERER,URL_PATH, SESSION_TIMESTAMP, username,CLIENT_IP, PACKET_IP
</query>
</search>
</table>
</panel>
</row>
</form>

[VatsalJagani]

@POR160893 - That's what we are trying to say.

When you write below

<drilldown>
<set token="tokComponent">$row.component$</set>
</drilldown>

you are trying to set the component column as part of the token. And then later in panel-2 which is the drilldown panel would use.

But I'm sure you will not have the component as a column in panel-1. Are you seeing the output in panel-1?

Can you please explain how these panels are related? And we'll help you fix the XML.

--------
A upvote would be appreciated!!!

[POR160893]

So, panel 1 shows a number of fields, with "Country" field being the most important.
The 2nd panel shows other field, with URL field being most important.

The SESSION_UUIS from table one should be the common field between both tables. If you click on a row on table 1, table 2 should appear, with only data relative to the SESSION_UUID of the row you clicked on table 1.

This is what I need to do .....

[ITWhisperer]

<set token="tokComponent">$row.SESSION_UUID$</set>

<query>
index=fraud_glassbox sourcetype="gb:hit" SESSION_UUID="$tokComponent$"
| table HEADER_REQUEST_REFERER,URL_PATH, SESSION_TIMESTAMP, username,CLIENT_IP, PACKET_IP
</query>

[POR160893]

Worked like a dream. Thanks a million and I gave you Karma 🙂