Splunk Enterprise

Drilldown table - by passing a fieldvalue , that doesnt exist in the final output

vn_g
Path Finder


Requirement : Onclicking the single value of the panel "DonwloadCountExceeded ( DailyLimit - 1 )" , "MoreDetails" panel have to be populated and when clicked again should be hidden.

Issue : "More Details" panel would need a field value "DownloadLimit" ( value varies per panel - daily,weekly,monthly) - doesnt exist in the final output of the actual panel "DonwloadCountExceeded ( DailyLimit - 1 )".

 

  <form>
<fieldset submitButton="false">
<input type="time" token="time">
<label>Select TIME :</label>
<default>
<earliest>-5m@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="homeOffice" searchWhenChanged="true">
<label>Select HomeOffice :</label>
<choice value="*">ALL</choice>
<default>*</default>
<search>
<query>source="http:datalog" sourcetype="datalog" homeOffice ="*"| search hrId= "$hrId$" email = "$email$" firstname = "$firstname$" lastname = "$lastname$" | dedup homeOffice | stats count by homeOffice</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<fieldForLabel>homeOffice</fieldForLabel>
<fieldForValue>homeOffice</fieldForValue>
</input>
<input type="text" token="hrId" searchWhenChanged="true">
<label>HrID :</label>
<default>*</default>
</input>
<input type="text" token="email" searchWhenChanged="true">
<label>Email :</label>
<default>*</default>
</input>
<input type="text" token="firstname" searchWhenChanged="true">
<label>FirstName :</label>
<default>*</default>
</input>
<input type="text" token="lastname" searchWhenChanged="true">
<label>LasttName :</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>DonwloadCountExceeded ( DailyLimit - 1 )</title>
<single>
<search>
<query>source="http:datalog" sourcetype="datalog"
hrId= "$hrId$" email = "$email$" firstname = "$firstname$" lastname = "$lastname$" homeOffice="$homeOffice$" | eval DownloadLimit = 1
| stats count by DownloadLimit
| where count &gt; DownloadLimit
| rename count as "DownloadCount"
| fields DownloadCount</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<drilldown>
<condition>
<set token="ShowDetails">true</set>
<set token="selected_value">$row.DownloadLimit$</set>
</condition>
</drilldown>
</single>
</panel>
</row>
<row depends="$ShowDetails$">
<panel>
<title>More Details</title>
<table>
<search>
<query>source="http:datalog" sourcetype="datalog"
hrId= "$hrId$" email = "$email$" firstname = "$firstname$" lastname = "$lastname$" homeOffice="$homeOffice$" | eval DownloadLimit = $selected_value$ | stats count by hrId email firstname lastname homeOffice
| where count &gt; DownloadLimit
| rename count as "DownloadCount"</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<unset token="ShowDetails"></unset>
</drilldown>
</table>
</panel>
</row>
</form>

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...