Splunk Search

Drill down using multiple conditions

kallisrayar1986
Path Finder

I have a pie chart with multiple slices, clicking on each slice will take you to Custom URL, please see the simple xml below:
Unfortunately it takes me to the same URL which is at the top,again and again. I even tried keeping this condition in one drilldown but still it did not work. Please help..

      <condition value="Media Content (Bytes)">
        <link>URL1</link>
        </condition>          
    </drilldown> 
    <drilldown>
      <condition value="Text Content (Bytes)">
             <link>URL2</link>    
       </condition>
    </drilldown>   
Tags (2)

martin_mueller
SplunkTrust
SplunkTrust

That's not going to work, the value attribute is only valid in the input context of the condition element, not in the drilldown context: http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/PanelreferenceforSimplifiedXML#condition_.28dr...

The only thing you can condition on here is the field name that was clicked, which in a pie is always the same field.

A possible workaround would be to have a small script on some web server that gets passed the clicked value in a parameter and then redirects to the appropriate URL.
Another possibility would be to add a custom JS event handler that suppresses the default drilldown and instead does its own logic.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There are plenty of custom JS examples here: https://apps.splunk.com/app/1603/ Not sure if they go far enough though.

0 Karma

kallisrayar1986
Path Finder

Could you please share some samples for Custome JS event for this scenario, if any?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...