In Splunk _everything_ is possible 😁 The same technique of using tokens - but you don't need the reject= token part as that hides the top panel. See this - there is a single <panel> element and inside that, there are two <table> elements - the second one uses depends= to only show it when you click in the top panel. By only using a single panel with 2 tables, they will be displayed one above, one below. Hope this helps <dashboard>
<label>Panels</label>
<row>
<panel>
<title>First Panel</title>
<table>
<search>
<query>| makeresults
| eval Item=split("Sourcing,Purchase,Project,Inventory",",")
| mvexpand Item
| table Item</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>row
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="item">$row.item$</set>
</drilldown>
</table>
<table depends="$item$">
<title>Second Panel</title>
<search>
<query>| makeresults
| eval DrillDownItem=split("Avg Procurement,Avg Requisition,Stock Out",",")
| mvexpand DrillDownItem
| table DrillDownItem</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>row
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<unset token="item"></unset>
</drilldown>
</table>
</panel>
</row>
</dashboard>
... View more
