Dashboards & Visualizations

clear token or rest the tokens for dependent drill down

venky1544
Builder

Hi All

i have a basic dashboard with two panels piechart and table when you click on the slice of pie the table shows the values of the selected pie  in the table  but how can i revert back to the original table like a clear filter for the tokens or a home button for the orginal table to display can this be achieved without a java script

 

<dashboard>
<label>DrillDown</label>
<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="tok_sourcetype">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel depends="$tok_sourcetype$">
<table>
<search>
<query>index=_* sourcetype=*|stats count by sourcetype |search sourcetype=$tok_sourcetype" OR sourcetype=$*" </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<unset token="tok_sourcetype"></unset>
</drilldown>
</table>
</panel>
</row>
</dashboard>

Labels (1)
0 Karma

venky1544
Builder

Hi dont want to Hide the table so when you open the dashboard first time you will see the a complete pie chart and a complete table with all sourcetypes now when you click on  any slice of the  pie  the table  shows only values for that particular sourcetype so basically a filter has been applied now the user wants to go back to the original table which has no filter from the piechart

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set the token to * in an init block, change it to the clicked value in the first drilldown, change it back to * in the second drilldown - you don't need depends on the second panel as that is usually used for hiding panels

<dashboard>
<label>DrillDown</label>
<init>
<set token="tok_sourcetype">*</set>
</init>
<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="tok_sourcetype">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<table>
<search>
<query>index=_* sourcetype=$tok_sourcetype$|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="tok_sourcetype">*</unset>
</drilldown>
</table>
</panel>
</row>
</dashboard>
0 Karma

venky1544
Builder

Thanks @ITWhisperer  thats was nice tweak but i needed something were a user can understand to go to home he doesn't need to click on the panels data so i made my own little modification and seem to be working for my usecase  just added a drop down panel and seems to work for me 

 

<form>
<label>DrillDown</label>

<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="form.field1">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<input type="dropdown" token="field1" searchWhenChanged="true">
<label>ALL Sourcetype</label>
<choice value="*">ALL</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=_* sourcetype=*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
</input>
<table>
<search>
<query>index=_* sourcetype=$field1$|stats count by sourcetype |search sourcetype="$form.field1$"</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="tok_sourcetype">*</set>
</drilldown>
</table>
</panel>
</row>
</form>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not entirely clear what you are trying to achieve. If you want to hide the table, the unset in the drilldown for the table will do that. If you want the table to remain but have all the detail, then the drilldown should set the token to *

Having said that, you should correct the search to use the token correctly

<query>index=_* sourcetype=$tok_sourcetype$|stats count by sourcetype</query>
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...