Splunk Search

How to create drilldown from a table with time in order to display more details?

jip31
Motivator

hello

As you can see, I use a table with one hour bin span and I need to drillwown on every row in order to display more details in another dashboard

 

jip31_0-1648049044274.png

how to do this please?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try it with click.value instead

   <drilldown>
          <condition match="'click.value'==&quot;CAP CLIENT - Nb d'erreurs&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
          </condition>
          <condition match="'click.value'==&quot;CAP CLIENT - Nb d'utilisateurs ayant un temps de réponse &gt; 7 sec&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
          </condition>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Enable drilldown for cells in the dashboard table definition. In the drilldown, you could link to another dashboard passing the references to the column and row. Alternatively, you could set tokens for these values and use them in a search for another panel within the same dashboard.

jip31
Motivator

Thanks

I have done this and it works fine

But the problem is that I need

<drilldown>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
</drilldown>
<drilldown>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
</drilldown>

The message is Expected at most 1 children of drilldown in table, instead saw 2
So I cant do this more than 1 time?
Is there e trick for changing this please?
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you want to open two (or more) tabs from one click, do it this way

<drilldown>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
</drilldown>
0 Karma

jip31
Motivator

No I dont want to open 2 or many tabs on one click

KPI is the colum_name of a transpose command

| transpose 0 header_field=time column_name=KPI 

So in this colum, there is many different fields

So what I need is to be able to click on this field and to open the dashboard corresponding

I tried something like this

 <drilldown>
          <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$"AB"$</link>
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$"CD"$</link>
        </drilldown>

It works because it open the dashboard but not the good

It eans thateven if I click on "AB" OR on "CD", its just the dash "heatmap_dash" which opens and not "heatmap_dash2"

Have you another idea please?

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does something like this work?

<drilldown>
<condition match="'click.name2'==&quot;AB&quot;">
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
</condition>
<condition match="'click.name2'==&quot;CD&quot;">
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
</condition>
</drilldown>
0 Karma

jip31
Motivator

Unfortunately not

I have repalce "AB" and "CD" with the good field name like below but when I click on the field it just open a new search

   <drilldown>
          <condition match="'click.name2'==&quot;CAP CLIENT - Nb d'erreurs&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
          </condition>
          <condition match="'click.name2'==&quot;CAP CLIENT - Nb d'utilisateurs ayant un temps de réponse &gt; 7 sec&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
          </condition>

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it with click.value instead

   <drilldown>
          <condition match="'click.value'==&quot;CAP CLIENT - Nb d'erreurs&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
          </condition>
          <condition match="'click.value'==&quot;CAP CLIENT - Nb d'utilisateurs ayant un temps de réponse &gt; 7 sec&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
          </condition>
0 Karma

jip31
Motivator

it's perfect

thanks for your precious help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

is "CAP CLIENT - Nb d'erreurs" the name of a column or the value in the first column?

0 Karma

jip31
Motivator

it's one of the value of the KPI column

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...