Splunk Search

Can you display a panel only if the user clicks on one specific column?

varun99
Path Finder

The requirement is to display a panel only if the user clicks on a specific column in a previous panel. Kindly help.

niketnilay
Legend

@varun99 usually more details of what you currently have and what you have tried would help us assist you better. You can definitely use the examples from Splunk Dashboard Examples App which has examples to set token based on table where any value for specific field is clicked. It also has example for showing and/or hiding panel depending on depends/rejects attributes.

Following is a run anywhere dashboard example based on Splunk's _internal index which sets specific token depending on clicked field name and shows/hide panel using depends attribute.

<dashboard>
  <label>Show Panel based on Column Click</label>
  <row>
    <panel>
      <title>Table for drilldown</title>
      <table>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*"
| timechart count by log_level</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="INFO">
            <set token="tokINFO">true</set>
            <unset token="tokWARN"></unset>
            <unset token="tokERROR"></unset>
          </condition>
          <condition field="WARN">
            <unset token="tokINFO"></unset>
            <set token="tokWARN">true</set>
            <unset token="tokERROR"></unset>
          </condition>
          <condition field="ERROR">
            <unset token="tokINFO"></unset>
            <unset token="tokWARN"></unset>
            <set token="tokERROR">ERROR</set>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$tokINFO$">
      <chart>
        <title>INFO details</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="INFO"
  | timechart count by component</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
      </chart>
    </panel>
    <panel depends="$tokWARN$">
      <chart>
        <title>WARN details</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="WARN"
  | timechart count by component</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
      </chart>
    </panel>
    <panel depends="$tokERROR$">
      <chart>
        <title>ERROR details</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="ERROR"
  | timechart count by component</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
      </chart>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.