Dashboards & Visualizations

clear token or rest the tokens for dependent drill down

venky1544
Builder

Hi All

i have a basic dashboard with two panels piechart and table when you click on the slice of pie the table shows the values of the selected pie  in the table  but how can i revert back to the original table like a clear filter for the tokens or a home button for the orginal table to display can this be achieved without a java script

 

<dashboard>
<label>DrillDown</label>
<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="tok_sourcetype">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel depends="$tok_sourcetype$">
<table>
<search>
<query>index=_* sourcetype=*|stats count by sourcetype |search sourcetype=$tok_sourcetype" OR sourcetype=$*" </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<unset token="tok_sourcetype"></unset>
</drilldown>
</table>
</panel>
</row>
</dashboard>

Labels (1)
0 Karma

venky1544
Builder

Hi dont want to Hide the table so when you open the dashboard first time you will see the a complete pie chart and a complete table with all sourcetypes now when you click on  any slice of the  pie  the table  shows only values for that particular sourcetype so basically a filter has been applied now the user wants to go back to the original table which has no filter from the piechart

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set the token to * in an init block, change it to the clicked value in the first drilldown, change it back to * in the second drilldown - you don't need depends on the second panel as that is usually used for hiding panels

<dashboard>
<label>DrillDown</label>
<init>
<set token="tok_sourcetype">*</set>
</init>
<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="tok_sourcetype">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<table>
<search>
<query>index=_* sourcetype=$tok_sourcetype$|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="tok_sourcetype">*</unset>
</drilldown>
</table>
</panel>
</row>
</dashboard>
0 Karma

venky1544
Builder

Thanks @ITWhisperer  thats was nice tweak but i needed something were a user can understand to go to home he doesn't need to click on the panels data so i made my own little modification and seem to be working for my usecase  just added a drop down panel and seems to work for me 

 

<form>
<label>DrillDown</label>

<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="form.field1">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<input type="dropdown" token="field1" searchWhenChanged="true">
<label>ALL Sourcetype</label>
<choice value="*">ALL</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=_* sourcetype=*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
</input>
<table>
<search>
<query>index=_* sourcetype=$field1$|stats count by sourcetype |search sourcetype="$form.field1$"</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="tok_sourcetype">*</set>
</drilldown>
</table>
</panel>
</row>
</form>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not entirely clear what you are trying to achieve. If you want to hide the table, the unset in the drilldown for the table will do that. If you want the table to remain but have all the detail, then the drilldown should set the token to *

Having said that, you should correct the search to use the token correctly

<query>index=_* sourcetype=$tok_sourcetype$|stats count by sourcetype</query>
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...