Splunk Search

how to create drilldown for specific value from multivalue row

Khushboo
Explorer

Hi Team,

I have a table where employee name are group by manager name and their project count.

PFB structure of my table in which i want to link to other dashboard (which have mgr and emp tokens for manager and employee name respectively) based on selection i did.


For selection of manager value i added this in link target.
form.mgr=$click.value$

I'm not sure how do i select employee name for his manager. Also, i want when i click on count no query string will add to query.

Suppose i click on Khushboo how would i get this link target search.
form.mgr=Shaurya&form.emp=Khushboo

Manager NameEmployee NameProject Count
ShauryaKhushboo
Neha
Sachin
23
30
12
MohanVirat14
HarryLarry23
MeghanJack
Nick
Carson
12
13
14
Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See the <condition> elements in the example. That should show you how to set the token for clicking on manager, i.e.

<condition field="manager">
  <set token="mgr_token">$row.manager$</set>
</condition>

Clicking on count is more difficult, as there is no simple way to work out the employee from the count, as the drilldown click.value2 token will not tell you which 'index' of the MV field in count is clicked, only the value and if you have duplicate values then you cannot work out the index.

If there is only a single distinct value, then you could make a count condition and use this condition syntax to work out the employee, but that will only work if all the counts are unique, otherwise it will pick the first employee with the matching count.

See this updated example.

<dashboard>
  <label>Multi value field drilldown</label>
  <row>
    <panel>
      <table>
        <title>Click on the employee</title>
        <search>
          <query>| makeresults
| eval manager=mvappend("Antony","Susan")
| mvexpand manager
| eval employee=mvrange(1,10), count=mvrange(44,53)
| table manager employee count</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="employee">
            <set token="emp_token">$click.value2$</set>
            <set token="mgr_token">$row.manager$</set>
            <unset token="cnt_token_click"></unset>
            <unset token="cnt_token_index"></unset>
          </condition>
          <condition field="manager">
            <set token="mgr_token">$row.manager$</set>
            <unset token="emp_token"></unset>
            <unset token="cnt_token_click"></unset>
            <unset token="cnt_token_index"></unset>
          </condition>
          <condition field="count">
            <set token="cnt_token_click">$click.value2$</set>
            <eval token="cnt_token_index">mvfind($row.count$,$click.value2$)</eval>
            <eval token="emp_token">mvindex($row.employee$,cnt_token_index)</eval>
            <set token="mgr_token">$row.manager$</set>
          </condition>
        </drilldown>
      </table>
    </panel>
    <panel>
      <html>
        <h1>Clicked values are manager=$mgr_token$, employee=$emp_token$, click=$cnt_token_click$, index=$cnt_token_index$</h1>
      </html>
    </panel>
  </row>
</dashboard>

 I don't think there's any way to solve this

View solution in original post

Khushboo
Explorer

Thanks for your reply.
But i want when i click on manager, token is set only for manager. when i click on emp token is set for that employee along with his assigned manager and when i click on project count token is set for emp and manager .
eg. when i click on 30 on above table i get 
form.mgr=Shaurya&form.emp=Neha

Means either i click on count or emp, i want token for manager and emp for clicked value

0 Karma

bowesmana
SplunkTrust
SplunkTrust

See the <condition> elements in the example. That should show you how to set the token for clicking on manager, i.e.

<condition field="manager">
  <set token="mgr_token">$row.manager$</set>
</condition>

Clicking on count is more difficult, as there is no simple way to work out the employee from the count, as the drilldown click.value2 token will not tell you which 'index' of the MV field in count is clicked, only the value and if you have duplicate values then you cannot work out the index.

If there is only a single distinct value, then you could make a count condition and use this condition syntax to work out the employee, but that will only work if all the counts are unique, otherwise it will pick the first employee with the matching count.

See this updated example.

<dashboard>
  <label>Multi value field drilldown</label>
  <row>
    <panel>
      <table>
        <title>Click on the employee</title>
        <search>
          <query>| makeresults
| eval manager=mvappend("Antony","Susan")
| mvexpand manager
| eval employee=mvrange(1,10), count=mvrange(44,53)
| table manager employee count</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="employee">
            <set token="emp_token">$click.value2$</set>
            <set token="mgr_token">$row.manager$</set>
            <unset token="cnt_token_click"></unset>
            <unset token="cnt_token_index"></unset>
          </condition>
          <condition field="manager">
            <set token="mgr_token">$row.manager$</set>
            <unset token="emp_token"></unset>
            <unset token="cnt_token_click"></unset>
            <unset token="cnt_token_index"></unset>
          </condition>
          <condition field="count">
            <set token="cnt_token_click">$click.value2$</set>
            <eval token="cnt_token_index">mvfind($row.count$,$click.value2$)</eval>
            <eval token="emp_token">mvindex($row.employee$,cnt_token_index)</eval>
            <set token="mgr_token">$row.manager$</set>
          </condition>
        </drilldown>
      </table>
    </panel>
    <panel>
      <html>
        <h1>Clicked values are manager=$mgr_token$, employee=$emp_token$, click=$cnt_token_click$, index=$cnt_token_index$</h1>
      </html>
    </panel>
  </row>
</dashboard>

 I don't think there's any way to solve this

bowesmana
SplunkTrust
SplunkTrust

In order to have drilldown work for an employee, you have to click the employee, any other click is meaningless, unless you want to handle that specifically.

See this example dashboard, that creates two rows with multiple employees per 'manager'.

If you click on either the manager or the count, nothing happens, but if you click on the employee, it sets tokens based on the manager and clicked employee.

<dashboard>
  <label>Multi value field drilldown</label>
  <row>
    <panel>
      <table>
        <title>Click on the employee</title>
        <search>
          <query>| makeresults
| eval manager=mvappend("Antony","Susan")
| mvexpand manager
| eval employee=mvrange(1,10), count=mvrange(44,53)
| table manager employee count</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition field="employee">
            <set token="emp_token">$click.value2$</set>
            <set token="mgr_token">$row.manager$</set>
          </condition>
          <condition>
            <unset token="emp_token"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
    <panel depends="$emp_token$">
      <html>
        <h1>Clicked values are manager=$mgr_token$, employee=$emp_token$</h1>
      </html>
    </panel>
    <panel rejects="$emp_token$">
      <html>
        <h1>Did not click on employee column</h1>
      </html>
    </panel>
  </row>
</dashboard>

Hope this helps

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...