Dashboards & Visualizations

How to configure Drilldown after using transpose command?

Marco_Develops
Path Finder

After issuing a transpose command on my bar chart visualization I can't configure conditional drilldowns.

I tried using the untable command followed by the xyz series command and no luck.

this is the query:

 

search * 
| eval CATI = if(SEVCAT=="I", 1,0) 
| eval CATII = if(SEVCAT=="II", 1,0) 
| eval CATIII = if(SEVCAT=="III", 1,0) 
| chart sum(CATI) as I sum(CATII) as II sum(CATIII) as III
| transpose
| sort - "row 1"

 

 

The Drilldown XML :

 

<drilldown>
          <condition field = "I">
            <link target="blank"></link>
          </condition>
          <condition field = "II">
            <link target="blank"></link>
          </condition>
          <condition field = "III">
            <link target="blank"></link>
          </condition>
</drilldown>

 

 

Any help is appreciated.

Thank you, 
Marco

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Because of the transpose, the field is now called "row 1" not "I" or "II", so you need to build your conditions based on what was clicked

        <drilldown>
          <condition match="'click.value' == &quot;I&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;II&quot;">
            <link target="blank"></link>
          </condition>
          <condition match="'click.value' == &quot;III&quot;">
            <link target="blank"></link>
          </condition>
        </drilldown>

Marco_Develops
Path Finder

@ITWhisperer  Thank you!! Also,  great explanation.

-Marco

0 Karma

Gr0und_Z3r0
Communicator

Hi @Marco_Develops 

Try the following. Update your search this way..

your base search
|chart count over SEVCAT

 

And configure the dashboard panel drilldown to the following.

Gr0und_Z3r0_0-1650586299751.png


If it helps, karma points are appreciated!

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...