token condition match

sahana · ‎03-27-2022

Hi,

I have a parent panel which has below table panel

Function Name	Success	Failure	SLA
greet	34	5	13.5
NGA	43	0	67.5
Customer	54	1	45

this has two drilldown panel

the 1st drilldown panel should appear if we click the column value failure.

the 2nd drilldown panel should appear if we click the column value SLA.

Thanks in advance,

kamlesh_vaghela · ‎03-27-2022

@sahana

Try this.

<dashboard>
  <label>Drilldown By Value</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval _raw="Function_Name,Success,Failure,SLA
greet,34,5,13.5
NGA,43,0,67.5
Customer,54,1,45" | multikv forceheader=1
| table Function_Name	Success	Failure	SLA</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="$click.name2$ ==&quot;Failure&quot;">
            <set token="flag">Failure Clicked. Value = $click.value2$</set>
          </condition>
          <condition match="$click.name2$ ==&quot;SLA&quot;">
            <set token="flag">SLA Clicked. Value = $click.value2$</set>
          </condition>
          <condition>
            <unset token="flag" />
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>$flag$</html>
    </panel>
  </row>
</dashboard>

Please refer below link for more info.

https://docs.splunk.com/Documentation/Splunk/8.2.5/Viz/DrilldownIntro

Thanks
KV

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

token condition match

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

token condition match

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future