- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: create a drill-down multiple condition
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Is it possible to set a drill-down condition only for the cells of a specific column but to exclude one cell.
For example:
row a | row b | row c |
--------|---------|---------|
a1 | b1 | c1
a2 | b2 | c2
a3 | b3 | c3
I'd like to be able to press only the values under "row a" but to also exclude the last value "a3".
Please help me achieve this goal
Thanks,
Sam
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@vshakur if you are on Splunk 6.5 or higher easiest option for you to be use add a Total Table Summary row which can not be used for Drilldown: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsFormatting#Totals_summary_row
This way your drilldown code would be enabled only for "row a" and Total row will not have drilldown enabled.
Otherwise you will have to use $row.yourfieldname$ to check for value Total and not perform any drilldown action.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@vshakur if you are on Splunk 6.5 or higher easiest option for you to be use add a Total Table Summary row which can not be used for Drilldown: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsFormatting#Totals_summary_row
This way your drilldown code would be enabled only for "row a" and Total row will not have drilldown enabled.
Otherwise you will have to use $row.yourfieldname$ to check for value Total and not perform any drilldown action.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@vshakur, I have converted my comment to answer. If it worked for you, please accept the same to mark this question as answered. If you need further details, do let us know. 🙂 Happy Weekend!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks but I'm still stuck.
Using Total Table Summary is not an option since some of the columns represent percentages and I don't want them to be summed up.
I have the following code:
<drilldown>
<condition field="Environment">
<eval token="form.environment_token">$click.value$</eval>
</condition>
</drilldown>
But I'm having trouble to add another condition to the existing one. Besides the field="Environment" condition I need to verify that the user won't be able to press the last cell in the column labeled Total
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Following is run anywhere example with Table Summary Row added. You can hide Total of percent column using CSS. Try the following run anywhere dashboard:
<dashboard>
<label>Table Summary Row CSS</label>
<row>
<panel>
<html depends="$alwaysHideCSSPanel$">
<style>
#tableWithSummary tbody tr:last-child td:last-child{
visibility:hidden !important;
}
#tableWithSummary tbody tr:last-child td{
background: #fff !important;
font-weight: bold !important;
}
</style>
</html>
<table id="tableWithSummary">
<search>
<query>index=_internal sourcetype=splunkd
| top 5 component</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">true</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>
Following is a run anywhere example with addtotals and eval to set token on Drilldown from the field count. In case the component value is Total (i.e. for the final row) then token is unset by not defining the default condition of the case statement.
<panel>
<table id="tableWithSummary2">
<title>$tokClickedValue$</title>
<search>
<query>index=_internal sourcetype=splunkd
| top 5 component
| addtotals col=t row=f labelfield=component label=Total
| eval percent=case(component!="Total",percent)
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="wrap">true</option>
<drilldown>
<condition field="count">
<eval token="tokClickedValue">case($row.component$!="Total",$row.count$)</eval>
</condition>
<condition>
<!-- Do not drilldown for other fields-->
</condition>
</drilldown>
</table>
</panel>
Please try out both options and confirm.
PS: you can also code drilldown to pick only the count field no matter which field is clicked, using the $row.count$ value.
<drilldown>
<eval token="tokClickedValue">case($row.component$!="Total",$row.count$)</eval>
</drilldown>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The last one did the trick. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer I can think of is it depends. In my mind, you would need to have a column that can label the horizontal row you want to exclude, e.g., exclude anything that belongs to the last row that has a label "Totals". Do you have any way of labeling the values you want to exclude? Or is it always the last value in the column?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's both. It's both the last row and It's always labeled "Total"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what is the name of the column that contains the label "Total"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Environment
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
