Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- Splunk Development
- :
- Splunk Dev
- :
- Load another panel when one row in a table is sele...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Currently i have a search which actually generally a stats for the number of application installed on a server. The list of servers is coming from the inputlookup command. This will give the number of apps installed on each host.
index=main sourcetype="Script:InstalledApps" [|inputlookup servers | rename Servers as host ]
| search DisplayName = Microsoft* | stats dc(DisplayName) by host
Now i want to list all the apps when i select a row in the above stats table. So basically i want to load another panel below the stats table which will just give the list of installed apps for the host selected.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
You can use the drilldown functionality.
You have to activate drilldown on the first table. And for the specific host column set up a token used by the second table.
You can even use "depends" in order to hide the panel when no row was selected.
<panel>
<table>
<title>main table</title>
<search>
<query>index=main sourcetype="Script:InstalledApps" [|inputlookup servers | rename Servers as host ] | search DisplayName = Microsoft* | stats dc(DisplayName) by host</query>
</search>
<option name="count">10</option>
<option name="drilldown">cell</option>
<option name="wrap">true</option>
<drilldown>
<condition field="host">
<set token="hostName">$click.value2$</set>
</condition>
<condition field="*">
<unset token="hostName"></unset>
</condition>
</drilldown>
</table>
</panel>
<panel depends="$hostName$">
<table>
<title>Detail table</title>
<search>
<query>index=main sourcetype="Script:InstalledApps" host=$hostName$ ...</query>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="wrap">true</option>
</table>
</panel>
Regards
Régis
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
You can use the drilldown functionality.
You have to activate drilldown on the first table. And for the specific host column set up a token used by the second table.
You can even use "depends" in order to hide the panel when no row was selected.
<panel>
<table>
<title>main table</title>
<search>
<query>index=main sourcetype="Script:InstalledApps" [|inputlookup servers | rename Servers as host ] | search DisplayName = Microsoft* | stats dc(DisplayName) by host</query>
</search>
<option name="count">10</option>
<option name="drilldown">cell</option>
<option name="wrap">true</option>
<drilldown>
<condition field="host">
<set token="hostName">$click.value2$</set>
</condition>
<condition field="*">
<unset token="hostName"></unset>
</condition>
</drilldown>
</table>
</panel>
<panel depends="$hostName$">
<table>
<title>Detail table</title>
<search>
<query>index=main sourcetype="Script:InstalledApps" host=$hostName$ ...</query>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="wrap">true</option>
</table>
</panel>
Regards
Régis
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does this help?
http://docs.splunk.com/Documentation/Splunk/7.0.3/Viz/tokens
Access tokens to show or hide user interface components
You can use token values to conditionally show or hide user interface components. The following elements contain the attributes depends and rejects. Use the and elements to set the token values that these attributes consume.
<row>
<panel>
<chart>
<event>
<html>
<map>
<single>
<table>
<input>
For example, show the element only when the showChart token has been set.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...
Introducing the 2026 - 2027 SplunkTrust cohort!
Pro Tips for .conf26: How to Prep Like a Splunk Veteran
