Dashboards & Visualizations

Drill down into table - fields for display

paddy3883
Path Finder

I've created a dashboard which contains a summary table for which I want to have a drill down into a second table which shows the events related to that summary record. I have the drill down working and displaying the rows needed, however it is displaying all fields for that event rather than the specific ones I've set. If I run the search query on its own through the Search app, or separately on a dashboard it displays the appropriate fields.

This is the macro search code

source="MySource" EventClass="MyStep" $Transaction$ | dedup StepName | convert ctime(_time) as Date| table StepName, Date, EventStatus, Timing.

Here is the XML for the dashboard:

<?xml version='1.0' encoding='utf-8'?>
<view refresh="900" template="dashboard.html">
<label>Synthetics Dashboard</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Sythetic Transaction Recent Status" autoRun="True">
<param name="search">
synthetics_transactionStatus(SyntheticTransaction)</param>
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
<module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Login Timing Last 4hrs">
<param name="search">synthetics_transactionSteps($Transaction$)</param>
<module name="ConvertToIntention">
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="Transaction">
<param name="value">$click.value$</param>
</param>
</param>
</param>
<module name="ConvertToDrilldownSearch">
<module name="SimpleResultsTable">
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>
</module>
</module>
</module>
</module>
</module>
</module>
</view>

Thanks in advance

Tags (1)
0 Karma
1 Solution

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

View solution in original post

paddy3883
Path Finder

I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.
<module name="SimpleResultsTable">
<param name="fields">StepName, Date, EventSeverity, Timing</param>
<param name="displayRowNumbers">off</param>
<param name="drilldown">row</param>...

aneeshkjm123
Path Finder

Nice post !

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...