There are a number of ways to achieve something like this. Uses a tab mechanism (using Splunk input type="link") to show groups of panels Use a small visualisation to show a "thumbnail" and then expand the chart and remove other thumbnails when clicking on the chart These all generally work through panel dependency and tokens to hide or show certain panels. The tab approach simply uses a <change> element in the <input> to set and unset tokens that show or hide panels relating to that tab <input id="cascade_group" type="link" token="tab">
<label>Cascade</label>
<choice value="l1">Tab 1</choice>
<choice value="l2">Tab 2</choice>
<default>l1</default>
<change>
<condition value="l1">
<unset token="show_l2"></unset>
<set token="show_l1"></set>
</condition>
<condition value="l2">
<unset token="show_l1"></unset>
<set token="show_l2"></set>
</condition>
</change>
</input> Use the <row depends="$show_l1$> syntax to show rows/panels for l1 panels and the same for l2. And this is the thumbnail approach which if you click on the second thumbnail, expands to the chart below and removes the other thumbnails. This is done by setting the height attribute of the chart through a token set by drilldown, e.g. something like this (but a little more complext) <option name="height">$varietal_height$</option>
<drilldown>
<set token="varietal_height">800</set>
<unset... tokens for other thumbnails>
</drilldown> Go checkout the XML reference and read about tokens and depends https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML
... View more
