Dashboards & Visualizations

clear token or rest the tokens for dependent drill down

venky1544
Builder

Hi All

i have a basic dashboard with two panels piechart and table when you click on the slice of pie the table shows the values of the selected pie  in the table  but how can i revert back to the original table like a clear filter for the tokens or a home button for the orginal table to display can this be achieved without a java script

 

<dashboard>
<label>DrillDown</label>
<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="tok_sourcetype">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel depends="$tok_sourcetype$">
<table>
<search>
<query>index=_* sourcetype=*|stats count by sourcetype |search sourcetype=$tok_sourcetype" OR sourcetype=$*" </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<unset token="tok_sourcetype"></unset>
</drilldown>
</table>
</panel>
</row>
</dashboard>

Labels (1)
0 Karma

venky1544
Builder

Hi dont want to Hide the table so when you open the dashboard first time you will see the a complete pie chart and a complete table with all sourcetypes now when you click on  any slice of the  pie  the table  shows only values for that particular sourcetype so basically a filter has been applied now the user wants to go back to the original table which has no filter from the piechart

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set the token to * in an init block, change it to the clicked value in the first drilldown, change it back to * in the second drilldown - you don't need depends on the second panel as that is usually used for hiding panels

<dashboard>
<label>DrillDown</label>
<init>
<set token="tok_sourcetype">*</set>
</init>
<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="tok_sourcetype">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<table>
<search>
<query>index=_* sourcetype=$tok_sourcetype$|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="tok_sourcetype">*</unset>
</drilldown>
</table>
</panel>
</row>
</dashboard>
0 Karma

venky1544
Builder

Thanks @ITWhisperer  thats was nice tweak but i needed something were a user can understand to go to home he doesn't need to click on the panels data so i made my own little modification and seem to be working for my usecase  just added a drop down panel and seems to work for me 

 

<form>
<label>DrillDown</label>

<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="form.field1">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<input type="dropdown" token="field1" searchWhenChanged="true">
<label>ALL Sourcetype</label>
<choice value="*">ALL</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=_* sourcetype=*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
</input>
<table>
<search>
<query>index=_* sourcetype=$field1$|stats count by sourcetype |search sourcetype="$form.field1$"</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="tok_sourcetype">*</set>
</drilldown>
</table>
</panel>
</row>
</form>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not entirely clear what you are trying to achieve. If you want to hide the table, the unset in the drilldown for the table will do that. If you want the table to remain but have all the detail, then the drilldown should set the token to *

Having said that, you should correct the search to use the token correctly

<query>index=_* sourcetype=$tok_sourcetype$|stats count by sourcetype</query>
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...