Splunk Enterprise

Single Value Drilldown not working in Dashboard Studio

mayurr98
Super Champion

Hello I am trying to drilldown on a single value panel but its not working.  looks simple but I am not sure what I am doing wrong. here is my source code

 

 

 

 

{
    "title": "Set Tokens on Click - Example",
    "description": "",
    "inputs": {
        "input_global_trp": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Global Time Range",
            "type": "input.timerange"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_column_chart": {
            "containerOptions": {},
            "context": {},
            "dataSources": {
                "primary": "ds_qBGlESX2"
            },
            "eventHandlers": [
                {
                    "options": {
                        "tokens": [
                            {
                                "key": "row.method.value",
                                "token": "method"
                            }
                        ]
                    },
                    "type": "drilldown.setToken"
                }
            ],
            "options": {},
            "showLastUpdated": false,
            "showProgressBar": false,
            "title": "HTTP Request Method",
            "type": "splunk.singlevalue"
        },
        "viz_pie_chart": {
            "dataSources": {
                "primary": "ds_c8AfQapt"
            },
            "title": "Response Codes for Method $method$",
            "type": "splunk.pie"
        }
    },
    "dataSources": {
        "ds_c8AfQapt": {
            "name": "Search_2",
            "options": {
                "query": "index=_internal method=$method$ | stats count by status"
            },
            "type": "ds.search"
        },
        "ds_qBGlESX2": {
            "name": "Search_1",
            "options": {
                "enableSmartSources": true,
                "query": "index=_internal method=GET | stats count by method"
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [
            "input_global_trp"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "structure": [
                    {
                        "item": "viz_column_chart",
                        "position": {
                            "h": 400,
                            "w": 600,
                            "x": 0,
                            "y": 0
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_pie_chart",
                        "position": {
                            "h": 400,
                            "w": 600,
                            "x": 600,
                            "y": 0
                        },
                        "type": "block"
                    }
                ],
                "type": "grid"
            }
        },
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}

 

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @mayurr98 

Unfortunately what you are trying to achieve isnt supported. You cannot reference row.<fieldName>.value in a splunk.singlevalue viz (See https://docs.splunk.com/Documentation/Splunk/9.4.0/DashStudio/tokens#:~:text=the%20location%20clicke...

You can only use "name" or "value".

*HOWEVER* - You could do something clever with "name" such as below, setting the name to the method value (in this example) - so the single value becomes GET=593,453 for the below, and clicking on it sets $method$=GET:

livehybrid_0-1740519685213.png

 

{
    "title": "Set Tokens on Click - Example",
    "description": "",
    "inputs": {
        "input_global_trp": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Global Time Range",
            "type": "input.timerange"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_column_chart": {
            "containerOptions": {},
            "dataSources": {
                "primary": "ds_qBGlESX2"
            },
            "eventHandlers": [
                {
                    "type": "drilldown.setToken",
                    "options": {
                        "tokens": [
                            {
                                "key": "name",
                                "token": "method"
                            }
                        ]
                    }
                }
            ],
            "showLastUpdated": false,
            "showProgressBar": false,
            "title": "HTTP Request Method",
            "type": "splunk.singlevalue",
            "options": {
                "majorValue": "> sparklineValues | lastPoint()",
                "trendValue": "> sparklineValues | delta(-2)"
            }
        },
        "viz_pie_chart": {
            "dataSources": {
                "primary": "ds_c8AfQapt"
            },
            "title": "Response Codes for Method $method$",
            "type": "splunk.pie"
        }
    },
    "dataSources": {
        "ds_c8AfQapt": {
            "name": "Search_2",
            "options": {
                "query": "index=_internal method=$method$ | stats count by status"
            },
            "type": "ds.search"
        },
        "ds_qBGlESX2": {
            "name": "Search_1",
            "options": {
                "enableSmartSources": true,
                "query": "index=_internal method=GET | stats count by method\n| eval {method}=count \n| fields - method count"
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "type": "absolute",
        "options": {
            "width": 1440,
            "height": 960,
            "display": "auto"
        },
        "structure": [
            {
                "item": "viz_column_chart",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 0,
                    "w": 250,
                    "h": 250
                }
            },
            {
                "item": "viz_pie_chart",
                "type": "block",
                "position": {
                    "x": 390,
                    "y": 0,
                    "w": 250,
                    "h": 250
                }
            }
        ],
        "globalInputs": [
            "input_global_trp"
        ]
    }
}

 Is this what you are looking for?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

View solution in original post

0 Karma

mayurr98
Super Champion

Yes this works. do you know how to link this table dynamically to reports?
I am trying to convert this to dashboard studio and I do not see an option to link reports dynamically. I know you can set token and then set custom link but then problem here is values have spaces in it which it does not recognize by default.

$rn$ in below example has spaces in it which URL doesnt recognize in dashboard studio.

 

 

<table>
        <title>test</title>
        <search>
          <query>index=_internal | stats count by savedsearch_name status
</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="link.inspectSearch.visible">0</option>
        <option name="link.openSearch.visible">0</option>
        <drilldown>
          <set token="rn">$row.savedsearch_name$</set>
          <link>
            <![CDATA[/app/search/report?s=$rn$
            ]]>
          </link>
        </drilldown>
      </table>

 

 

 

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @mayurr98 

Try using $rn|s$ which puts quotes around the token output. 
does that work?

 

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @mayurr98 

Unfortunately what you are trying to achieve isnt supported. You cannot reference row.<fieldName>.value in a splunk.singlevalue viz (See https://docs.splunk.com/Documentation/Splunk/9.4.0/DashStudio/tokens#:~:text=the%20location%20clicke...

You can only use "name" or "value".

*HOWEVER* - You could do something clever with "name" such as below, setting the name to the method value (in this example) - so the single value becomes GET=593,453 for the below, and clicking on it sets $method$=GET:

livehybrid_0-1740519685213.png

 

{
    "title": "Set Tokens on Click - Example",
    "description": "",
    "inputs": {
        "input_global_trp": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Global Time Range",
            "type": "input.timerange"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_column_chart": {
            "containerOptions": {},
            "dataSources": {
                "primary": "ds_qBGlESX2"
            },
            "eventHandlers": [
                {
                    "type": "drilldown.setToken",
                    "options": {
                        "tokens": [
                            {
                                "key": "name",
                                "token": "method"
                            }
                        ]
                    }
                }
            ],
            "showLastUpdated": false,
            "showProgressBar": false,
            "title": "HTTP Request Method",
            "type": "splunk.singlevalue",
            "options": {
                "majorValue": "> sparklineValues | lastPoint()",
                "trendValue": "> sparklineValues | delta(-2)"
            }
        },
        "viz_pie_chart": {
            "dataSources": {
                "primary": "ds_c8AfQapt"
            },
            "title": "Response Codes for Method $method$",
            "type": "splunk.pie"
        }
    },
    "dataSources": {
        "ds_c8AfQapt": {
            "name": "Search_2",
            "options": {
                "query": "index=_internal method=$method$ | stats count by status"
            },
            "type": "ds.search"
        },
        "ds_qBGlESX2": {
            "name": "Search_1",
            "options": {
                "enableSmartSources": true,
                "query": "index=_internal method=GET | stats count by method\n| eval {method}=count \n| fields - method count"
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "type": "absolute",
        "options": {
            "width": 1440,
            "height": 960,
            "display": "auto"
        },
        "structure": [
            {
                "item": "viz_column_chart",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 0,
                    "w": 250,
                    "h": 250
                }
            },
            {
                "item": "viz_pie_chart",
                "type": "block",
                "position": {
                    "x": 390,
                    "y": 0,
                    "w": 250,
                    "h": 250
                }
            }
        ],
        "globalInputs": [
            "input_global_trp"
        ]
    }
}

 Is this what you are looking for?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...