Splunk Search

How do I disable drill down (completely) for certain columns in a table?

nick405060
Motivator

Hi there,

I need to disable drilldown on certain columns. Unlike the answer given here...

https://answers.splunk.com/answers/11486/disable-drilldown-on-specific-cell-in-simpleresultstable.ht...

...disabling actually means disabling. I need the non-drilldown columns to not have blue text and instead look like if you did <drilldown>none</drilldown> for the whole table

1 Solution

jeffland
SplunkTrust
SplunkTrust

Disabling drilldown on selected columns only is not configurable in Simple XML. You'll have to resort to JS. You could use a custom table cell renderer to do that without a lot of work though. See these docs and this more in-depth answer by @niketnilay to see how to implement custom table cell renderers.

Once you have a cell renderer up and running for your table is checking that you enable drill down in Simple XML while making the custom renderer only apply to those columns you want to disable the drilldown for (using the function canRender()). If your renderer only outputs plain text, they should not have any drill down function and appear as simple text. Unfortunately, I can't try this right now so I can't give you a working example. But feel free to come back with any trouble you might encounter.

By the way, based on your other questions, you should also check out the Dashboard Examples App and also the app Splunk Dev For All, they feature a lot of good examples and content to help you develop dashboards and other cool stuff.

View solution in original post

niketn
Legend

@helge refer to one of my older answers. https://answers.splunk.com/answers/661140/how-can-i-use-drilldown-in-one-cell-and-hide-the-m.html

Besides CSS you will have to disable drilldown for fields other that process ID field. You can use the following apporach (since you have not provided any details of your existing fields table drilldown it is based on assumptions)

   <drilldown>
     <condition field="processIDFieldName">
        <yourDrilldownCodeGoesHere>
     </condition>
     <condition>
          <!-- NO DRILLDOWN FOR OTHER FIELDS -->
     </condition>
    </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

helge
Builder

@niketnilay Thanks, I had already done the disabling, but I wanted the disabled fields to look that way, too. The following two CSS properties from the answer you linked to proved to be useful: cursor: default; color: black !important;.

0 Karma

niketn
Legend

@helge I am glad the solution worked. If you have multiple fields for drilldown you will have to apply CSS accordingly. Let me know if you still need more help!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @nick405060

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

jeffland
SplunkTrust
SplunkTrust

Disabling drilldown on selected columns only is not configurable in Simple XML. You'll have to resort to JS. You could use a custom table cell renderer to do that without a lot of work though. See these docs and this more in-depth answer by @niketnilay to see how to implement custom table cell renderers.

Once you have a cell renderer up and running for your table is checking that you enable drill down in Simple XML while making the custom renderer only apply to those columns you want to disable the drilldown for (using the function canRender()). If your renderer only outputs plain text, they should not have any drill down function and appear as simple text. Unfortunately, I can't try this right now so I can't give you a working example. But feel free to come back with any trouble you might encounter.

By the way, based on your other questions, you should also check out the Dashboard Examples App and also the app Splunk Dev For All, they feature a lot of good examples and content to help you develop dashboards and other cool stuff.

helge
Builder

Does not work

0 Karma

niketn
Legend

@helge what is your use case for disabling the drilldown? Have you posted your question on Splunk Answers since this is already accepted answer? If you have table for drilldown which fields are for drilldown and which fields are not?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

helge
Builder

I am using two columns (containing process IDs) for in-page drilldown. The other columns contain various process properties and cannot be used to select a drilldown item. That is why I want to disable the drilldown capability on them.
What I have done now is to switch the mouse cursor back to the default with this CSS: cursor: default;.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...