Splunk Search

How to create drilldown from a table with time in order to display more details?

jip31
Motivator

hello

As you can see, I use a table with one hour bin span and I need to drillwown on every row in order to display more details in another dashboard

 

jip31_0-1648049044274.png

how to do this please?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try it with click.value instead

   <drilldown>
          <condition match="'click.value'==&quot;CAP CLIENT - Nb d'erreurs&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
          </condition>
          <condition match="'click.value'==&quot;CAP CLIENT - Nb d'utilisateurs ayant un temps de réponse &gt; 7 sec&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
          </condition>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Enable drilldown for cells in the dashboard table definition. In the drilldown, you could link to another dashboard passing the references to the column and row. Alternatively, you could set tokens for these values and use them in a search for another panel within the same dashboard.

jip31
Motivator

Thanks

I have done this and it works fine

But the problem is that I need

<drilldown>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
</drilldown>
<drilldown>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
</drilldown>

The message is Expected at most 1 children of drilldown in table, instead saw 2
So I cant do this more than 1 time?
Is there e trick for changing this please?
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you want to open two (or more) tabs from one click, do it this way

<drilldown>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
</drilldown>
0 Karma

jip31
Motivator

No I dont want to open 2 or many tabs on one click

KPI is the colum_name of a transpose command

| transpose 0 header_field=time column_name=KPI 

So in this colum, there is many different fields

So what I need is to be able to click on this field and to open the dashboard corresponding

I tried something like this

 <drilldown>
          <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$"AB"$</link>
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$"CD"$</link>
        </drilldown>

It works because it open the dashboard but not the good

It eans thateven if I click on "AB" OR on "CD", its just the dash "heatmap_dash" which opens and not "heatmap_dash2"

Have you another idea please?

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does something like this work?

<drilldown>
<condition match="'click.name2'==&quot;AB&quot;">
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
</condition>
<condition match="'click.name2'==&quot;CD&quot;">
<link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
</condition>
</drilldown>
0 Karma

jip31
Motivator

Unfortunately not

I have repalce "AB" and "CD" with the good field name like below but when I click on the field it just open a new search

   <drilldown>
          <condition match="'click.name2'==&quot;CAP CLIENT - Nb d'erreurs&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
          </condition>
          <condition match="'click.name2'==&quot;CAP CLIENT - Nb d'utilisateurs ayant un temps de réponse &gt; 7 sec&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
          </condition>

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it with click.value instead

   <drilldown>
          <condition match="'click.value'==&quot;CAP CLIENT - Nb d'erreurs&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash?form.KPI=$click.value$</link>
          </condition>
          <condition match="'click.value'==&quot;CAP CLIENT - Nb d'utilisateurs ayant un temps de réponse &gt; 7 sec&quot;">
            <link target="_blank">/app/spl_publication_dashboard/heatmap_dash2?form.KPI=$click.value$</link>
          </condition>
0 Karma

jip31
Motivator

it's perfect

thanks for your precious help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

is "CAP CLIENT - Nb d'erreurs" the name of a column or the value in the first column?

0 Karma

jip31
Motivator

it's one of the value of the KPI column

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...