Why is my dashboard drilldown not working?

[Abilan1]

Hi Team,

I have created a dashboard for the search string below:

index=e1 *Done setting IPC Handle State structures to abandoned, process exiting immediately host=c2e9nqaa1

And I have enabled the Drilldown option while creating the Dashboard. After that in Dashboard, if I click any bar, it is not drilling down that bar and it is not giving those results in search. I am able to click it, but it is not doing anything.

Please help me here.

Regards,
Abilan

[nbdesale29]

Its so irritating. The drilldown is not even responding.
I am in the middle of the project and it stopped responding.

[niketn]

@nbdesale29 for the community to assist you better please post more details on what you are trying to do where is the drilldown and what does not seem to work? What do you mean by stopped responding? Share sample code and data (mock/anonymize any sensitive information).

Also rather than commenting on a 5 year old thread post a new question with all the relevant details so that it gets appropriate attention from community members.

[gyslainlatsa]

hi,
this is a example of the xml drilldown code that use

<form>
  <label>In-Page Drilldown project1</label>
  <description>The click in a table row display bolow a chart with the count number of host and source from the host selected</description>
  <fieldset submitButton="false">
    <!--
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
         -->
    <input type="text" token="Host" searchWhenChanged="true"/>
  </fieldset>
  <row>
    <table id="master">
      <title>Display of all the Host, Source and Description</title>
      <searchString>index=project1_index | rex "\d+\-\d+\-\d+ \d+\:\d+:\d+ (?<Host>[a-zA-Z0-9.-]+)"             
| rex max_match=0 "(?i) STRING: \"\"(?P<Description>[^\"]+)"       
| eval Source=mvindex(Description,0)        
| eval Description=mvindex(Description,1)|table Host Source Description</searchString>
      <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
      <option name="drilldown">row</option>
      <drilldown>
        <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
        <set token="Host">$row.Host$</set>
        <!-- If we also set the form.sourcetype the input will get updated too -->
        <set token="form.Host">$row.Host$</set>
      </drilldown>
    </table>
  </row>
  <row>
    <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
    <chart id="detail" depends="$Host$">
      <title>Count number of Descriptions and Sources from the Host selected: $Host$</title>
      <searchString>index=project1_index $Host$| rex "\d+\-\d+\-\d+ \d+\:\d+:\d+ (?<Host>[a-zA-Z0-9.-]+)"             
  | rex max_match=0 "(?i) STRING: \"\"(?P&lt;Description&gt;[^\"]+)"      
 |eval Source=mvindex(Description,0)|eval Description=mvindex(Description,1)|stats count(Source), count(Description) by Host
    </chart>
  </row>
</form>

[gyslainlatsa]

hi Abilan1,

Forgiveness post all your XML code with the integrated drilldown

[martin_mueller]

Do post your dashboard panel's XML.

[Abilan1]

Hi Matrin.
Source XML:

COK_Kernel_Crash
Call Object Crash

<panel>
  <chart>
    <title>Date</title>
    <search>
      <query>| pivot App_Log11 EventObject count(EventObject) AS "Zombies" SPLITROW date_mday AS Date SPLITCOL date_mday SORT 100 date_mday ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 0</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Zombies</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
  </chart>
</panel>

[martin_mueller]

Your question's search string and this search string don't match. Make sure you've posted the right things.