- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hello I am trying to drilldown on a single value panel but its not working. looks simple but I am not sure what I am doing wrong. here is my source code
{
"title": "Set Tokens on Click - Example",
"description": "",
"inputs": {
"input_global_trp": {
"options": {
"defaultValue": "-24h@h,now",
"token": "global_time"
},
"title": "Global Time Range",
"type": "input.timerange"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
}
}
},
"visualizations": {
"viz_column_chart": {
"containerOptions": {},
"context": {},
"dataSources": {
"primary": "ds_qBGlESX2"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "row.method.value",
"token": "method"
}
]
},
"type": "drilldown.setToken"
}
],
"options": {},
"showLastUpdated": false,
"showProgressBar": false,
"title": "HTTP Request Method",
"type": "splunk.singlevalue"
},
"viz_pie_chart": {
"dataSources": {
"primary": "ds_c8AfQapt"
},
"title": "Response Codes for Method $method$",
"type": "splunk.pie"
}
},
"dataSources": {
"ds_c8AfQapt": {
"name": "Search_2",
"options": {
"query": "index=_internal method=$method$ | stats count by status"
},
"type": "ds.search"
},
"ds_qBGlESX2": {
"name": "Search_1",
"options": {
"enableSmartSources": true,
"query": "index=_internal method=GET | stats count by method"
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_global_trp"
],
"layoutDefinitions": {
"layout_1": {
"structure": [
{
"item": "viz_column_chart",
"position": {
"h": 400,
"w": 600,
"x": 0,
"y": 0
},
"type": "block"
},
{
"item": "viz_pie_chart",
"position": {
"h": 400,
"w": 600,
"x": 600,
"y": 0
},
"type": "block"
}
],
"type": "grid"
}
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
}
}
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi @mayurr98
Unfortunately what you are trying to achieve isnt supported. You cannot reference row.<fieldName>.value in a splunk.singlevalue viz (See https://docs.splunk.com/Documentation/Splunk/9.4.0/DashStudio/tokens#:~:text=the%20location%20clicke...
You can only use "name" or "value".
*HOWEVER* - You could do something clever with "name" such as below, setting the name to the method value (in this example) - so the single value becomes GET=593,453 for the below, and clicking on it sets $method$=GET:
{
"title": "Set Tokens on Click - Example",
"description": "",
"inputs": {
"input_global_trp": {
"options": {
"defaultValue": "-24h@h,now",
"token": "global_time"
},
"title": "Global Time Range",
"type": "input.timerange"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
}
}
},
"visualizations": {
"viz_column_chart": {
"containerOptions": {},
"dataSources": {
"primary": "ds_qBGlESX2"
},
"eventHandlers": [
{
"type": "drilldown.setToken",
"options": {
"tokens": [
{
"key": "name",
"token": "method"
}
]
}
}
],
"showLastUpdated": false,
"showProgressBar": false,
"title": "HTTP Request Method",
"type": "splunk.singlevalue",
"options": {
"majorValue": "> sparklineValues | lastPoint()",
"trendValue": "> sparklineValues | delta(-2)"
}
},
"viz_pie_chart": {
"dataSources": {
"primary": "ds_c8AfQapt"
},
"title": "Response Codes for Method $method$",
"type": "splunk.pie"
}
},
"dataSources": {
"ds_c8AfQapt": {
"name": "Search_2",
"options": {
"query": "index=_internal method=$method$ | stats count by status"
},
"type": "ds.search"
},
"ds_qBGlESX2": {
"name": "Search_1",
"options": {
"enableSmartSources": true,
"query": "index=_internal method=GET | stats count by method\n| eval {method}=count \n| fields - method count"
},
"type": "ds.search"
}
},
"layout": {
"type": "absolute",
"options": {
"width": 1440,
"height": 960,
"display": "auto"
},
"structure": [
{
"item": "viz_column_chart",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 250,
"h": 250
}
},
{
"item": "viz_pie_chart",
"type": "block",
"position": {
"x": 390,
"y": 0,
"w": 250,
"h": 250
}
}
],
"globalInputs": [
"input_global_trp"
]
}
}
Is this what you are looking for?
Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards
Will
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Yes this works. do you know how to link this table dynamically to reports?
I am trying to convert this to dashboard studio and I do not see an option to link reports dynamically. I know you can set token and then set custom link but then problem here is values have spaces in it which it does not recognize by default.
$rn$ in below example has spaces in it which URL doesnt recognize in dashboard studio.
<table>
<title>test</title>
<search>
<query>index=_internal | stats count by savedsearch_name status
</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="drilldown">row</option>
<option name="link.inspectSearch.visible">0</option>
<option name="link.openSearch.visible">0</option>
<drilldown>
<set token="rn">$row.savedsearch_name$</set>
<link>
<![CDATA[/app/search/report?s=$rn$
]]>
</link>
</drilldown>
</table>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi @mayurr98
Unfortunately what you are trying to achieve isnt supported. You cannot reference row.<fieldName>.value in a splunk.singlevalue viz (See https://docs.splunk.com/Documentation/Splunk/9.4.0/DashStudio/tokens#:~:text=the%20location%20clicke...
You can only use "name" or "value".
*HOWEVER* - You could do something clever with "name" such as below, setting the name to the method value (in this example) - so the single value becomes GET=593,453 for the below, and clicking on it sets $method$=GET:
{
"title": "Set Tokens on Click - Example",
"description": "",
"inputs": {
"input_global_trp": {
"options": {
"defaultValue": "-24h@h,now",
"token": "global_time"
},
"title": "Global Time Range",
"type": "input.timerange"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
}
}
},
"visualizations": {
"viz_column_chart": {
"containerOptions": {},
"dataSources": {
"primary": "ds_qBGlESX2"
},
"eventHandlers": [
{
"type": "drilldown.setToken",
"options": {
"tokens": [
{
"key": "name",
"token": "method"
}
]
}
}
],
"showLastUpdated": false,
"showProgressBar": false,
"title": "HTTP Request Method",
"type": "splunk.singlevalue",
"options": {
"majorValue": "> sparklineValues | lastPoint()",
"trendValue": "> sparklineValues | delta(-2)"
}
},
"viz_pie_chart": {
"dataSources": {
"primary": "ds_c8AfQapt"
},
"title": "Response Codes for Method $method$",
"type": "splunk.pie"
}
},
"dataSources": {
"ds_c8AfQapt": {
"name": "Search_2",
"options": {
"query": "index=_internal method=$method$ | stats count by status"
},
"type": "ds.search"
},
"ds_qBGlESX2": {
"name": "Search_1",
"options": {
"enableSmartSources": true,
"query": "index=_internal method=GET | stats count by method\n| eval {method}=count \n| fields - method count"
},
"type": "ds.search"
}
},
"layout": {
"type": "absolute",
"options": {
"width": 1440,
"height": 960,
"display": "auto"
},
"structure": [
{
"item": "viz_column_chart",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 250,
"h": 250
}
},
{
"item": "viz_pie_chart",
"type": "block",
"position": {
"x": 390,
"y": 0,
"w": 250,
"h": 250
}
}
],
"globalInputs": [
"input_global_trp"
]
}
}
Is this what you are looking for?
Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards
Will
