Hi Team,
I have two panels . For my 1st panel the query is:
<title>DataGraphNodes Exceptions Details</title>
<table>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="*" |rex field=_raw "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|stats count by ns app_name node nodeMethodName nodeException datetime |rename node as "Node"| rename nodeMethodName as "NodeMethod"|rename nodeException as "Node-Exception" | rename datetime as "Log_Time"|fields - count</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</table>
And I am getting result like this:
ns app-name Node Node method Exception Log-Time
sidh-datagraph3 data-graph-acct-b https getDetailsBySENo Invalid Id 2022-06-21
sidh2 data-acct-b https invalid InvalidId 2022-06-22
Foe 2nd panel I want when I click on 1st panel row the details should come based on the row I will select on 1st panel.
My 2nd panel query is:
<panel depends="$show_panel$">
<table>
<title> Events</title>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException $node$ $selected_value$ </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
</table>
</panel>
But its not coming proper in 2nd panel all the results are coming. I want only the row that I select in 1st panel that exception will come.
Can someone guide me.
Hi @aditsss,
you should see in the splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603/) there's an example that exactly answers to your need: "In-page Drilldown with Perma-Linking".
Anyway, the problem is that with click.value you tale only one value, instead you have to take more values, so, use the $row.<field>$ option to set values:
<set token="node">$row.node$</set>
<set token="selected_value">$row.selected_value$</set>
Ciao.
Giuseppe
I made the below changes in 1st panel dashboard
<title>DataGraphNodes Exceptions Details</title>
<table>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="*" |rex field=_raw "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|stats count by ns app_name node nodeMethodName nodeException datetime |rename node as "Node"| rename nodeMethodName as "NodeMethod"|rename nodeException as "Node-Exception" | rename datetime as "Log_Time"|fields - count</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<drilldown>
<set token="show_panel">true</set>
<set token="node">$row.node$</set>
<set token="selected_value">$row.selected_value$</set>
</drilldown>
</table>
</panel>
NO RESULT FOUND IS COMING IN 2ND DASHBORAD
Hi @aditsss,
what's the search in panle2?
you should try:
index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="$node$" selected_value="$selected_value$"
then check if the fields in panel2 are correct and if the values from Panel1 match some value in panel 2.
Ciao.
Giuseppe
The data is still not coming in 2nd panel
My 1st panel query
<panel>
<title>DataGraphNodes Exceptions Details</title>
<table>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="*" |rex field=_raw "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|stats count by ns app_name node nodeMethodName nodeException datetime |rename node as "Node"| rename nodeMethodName as "NodeMethod"|rename nodeException as "Node-Exception" | rename datetime as "Log_Time"|fields - count</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<drilldown>
<set token="show_panel">true</set>t>
<set token="selected_value">$row.selected_value$</set>
</drilldown>
</table>
</panel>
My 2nd panel query
<panel depends="$show_panel$">
<table>
<title> Events</title>
<search>
<query>index=abc ns=sidh-datagraph3-c2 OR sidh-datagraph3 nodeException node="*" selected_value="$selected_value$" </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
</table>
</panel>
Hi @aditsss,
as I said:
first check:
second check:
Ciao.
Giuseppe