Dashboards & Visualizations

Why is my dashboard drilldown not working?

Abilan1
Path Finder

Hi Team,

I have created a dashboard for the search string below:

index=e1 *Done setting IPC Handle State structures to abandoned, process exiting immediately host=c2e9nqaa1

And I have enabled the Drilldown option while creating the Dashboard. After that in Dashboard, if I click any bar, it is not drilling down that bar and it is not giving those results in search. I am able to click it, but it is not doing anything.

Please help me here.

Regards,
Abilan

Tags (2)
0 Karma

nbdesale29
New Member

Its so irritating. The drilldown is not even responding.
I am in the middle of the project and it stopped responding.

0 Karma

niketn
Legend

@nbdesale29 for the community to assist you better please post more details on what you are trying to do where is the drilldown and what does not seem to work? What do you mean by stopped responding? Share sample code and data (mock/anonymize any sensitive information).

Also rather than commenting on a 5 year old thread post a new question with all the relevant details so that it gets appropriate attention from community members.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gyslainlatsa
Motivator

hi,
this is a example of the xml drilldown code that use

<form>
  <label>In-Page Drilldown project1</label>
  <description>The click in a table row display bolow a chart with the count number of host and source from the host selected</description>
  <fieldset submitButton="false">
    <!--
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
         -->
    <input type="text" token="Host" searchWhenChanged="true"/>
  </fieldset>
  <row>
    <table id="master">
      <title>Display of all the Host, Source and Description</title>
      <searchString>index=project1_index | rex "\d+\-\d+\-\d+ \d+\:\d+:\d+ (?<Host>[a-zA-Z0-9.-]+)"             
| rex max_match=0 "(?i) STRING: \"\"(?P<Description>[^\"]+)"       
| eval Source=mvindex(Description,0)        
| eval Description=mvindex(Description,1)|table Host Source Description</searchString>
      <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
      <option name="drilldown">row</option>
      <drilldown>
        <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
        <set token="Host">$row.Host$</set>
        <!-- If we also set the form.sourcetype the input will get updated too -->
        <set token="form.Host">$row.Host$</set>
      </drilldown>
    </table>
  </row>
  <row>
    <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
    <chart id="detail" depends="$Host$">
      <title>Count number of Descriptions and Sources from the Host selected: $Host$</title>
      <searchString>index=project1_index $Host$| rex "\d+\-\d+\-\d+ \d+\:\d+:\d+ (?<Host>[a-zA-Z0-9.-]+)"             
  | rex max_match=0 "(?i) STRING: \"\"(?P&lt;Description&gt;[^\"]+)"      
 |eval Source=mvindex(Description,0)|eval Description=mvindex(Description,1)|stats count(Source), count(Description) by Host
    </chart>
  </row>
</form>
0 Karma

gyslainlatsa
Motivator

hi Abilan1,

Forgiveness post all your XML code with the integrated drilldown

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Do post your dashboard panel's XML.

0 Karma

Abilan1
Path Finder

Hi Matrin.
Source XML:

COK_Kernel_Crash
Call Object Crash

<panel>
  <chart>
    <title>Date</title>
    <search>
      <query>| pivot App_Log11 EventObject count(EventObject) AS "Zombies" SPLITROW date_mday AS Date SPLITCOL date_mday SORT 100 date_mday ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 0</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Zombies</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
  </chart>
</panel>
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Your question's search string and this search string don't match. Make sure you've posted the right things.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...