Splunk Search

chart drill down to table

aaronkorn
Splunk Employee
Splunk Employee

Hello,

We have the following table with this search but would like to drill down to a table with just the ticket detail for that particular day we select rather than the raw events. Which advance xml or guide should we reference to help with this?

Here is the search:

index=reporter | dedup TKT_NUMBER | eval time=strptime(LASTOCCURRENCE, "%b %d %Y %I:%M%p") | bucket time span=1d | convert timeformat="%b %d" ctime("time") | chart count by NOTIFY_GROUP, time | rename NOTIFY_GROUP AS Group

alt text

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi aaronkorn,

try the sample in the docs about dynamic drilldown http://docs.splunk.com/Documentation/Splunk/5.0.4/Viz/Dynamicdrilldownindashboardsandforms and you should be able to get the result you want.

cheers, MuS

dart
Splunk Employee
Splunk Employee

If you switch out to using a timechart with a span you should be able to use the standard cell drilldown, and switch out your renames and converts to using fieldformat.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...