Dashboards & Visualizations

How to create a dynamic drilldown from chart's legend to populate a new dashboard?

frederick_lefeb
New Member

[I edited this question to reflect further investigation I did]
I created a dashboard that contains a series of timecharts from pivots. I'm trying to create a dynamic drilldown to send user to another dashboard with they click on a specific field.

Following the documentation, I added a marker inside a section on my dashboard like so:

<panel>
      <chart>
        <title>Data transfered by System - Consortia : $consortia$</title>
        <searchString>| pivot globus MyData sum(TB) AS "TB transfered" FILTER CONSORTIUM is $site$ SPLITROW _time AS _time PERIOD day SPLITCOL SYSTEM_NAME SORT 0 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 25 SHOWOTHER 1</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisY2.enabled">false</option>
        ....
        <drilldown target="DrillDown test">
          <link>
             globus_usage_per_system?form.system=$click.value$
           </link>
        </drilldown> 
      </chart>
</panel>

The link works but $click.value$ is not replaced and so, in the resulting URL, I get '$click.value$' instead of the actual value. I later noticed that if I click inside the graph, it seems to work. My issue is I want to click on the chart's legend to populate a new dashboard from the legend entry that was clicked. Is that possible ?

0 Karma

ngatchasandra
Builder

during tests of your process , i received always error due to name of view that concern a alphanumeric caracters, please if you can specify all your code precisely, this will help me exactly. I try to do your process like this, but it return the results drildown in the same dashboard:

<row>
        <chart id="master">
            <title>Master</title>
            <searchString>...........field</searchString>
            <earliestTime></earliestTime>
            <latestTime></latestTime>

            <option name="drilldown">bar</option>
            <drilldown>

                <set token="field">$bar.field$</set>
                <!-- If we also set the form.sourcetype the input will get updated too -->
                <set token="form.field">$bar.field$</set>
            </drilldown>
        </chart>
    </row>
    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <chart id="detail" depends="$field$">
            <title>Detail: $field$</title>
            <searchTemplate>index=.... field=$field$ | timechart count</searchTemplate>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
        </chart>
    </row>
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...