Dashboards & Visualizations

Drilldown - Manipulate click.value before redirect

bruceclarke
Contributor

All,

I have a dashboard panel to which I want to add a drilldown. The problem is that the value I display and the value I want to pass to the drilldown are different. To give you a sense, here's my search:

Message="BrowserLogging" Browser="$browserId$"
| rename Data.GroupId as groupId 
| lookup groupIdToName groupId 
| chart count over groupName by Browser

This search results in a table visualization. When I click on a row of that table, I want to use the groupId (not the displayed groupName) as the field that I pass to the drilldown. Right now I have the following:

<drilldown target="View by user">
  <condition field="groupName">
    <link>
      <![CDATA[
          /app/search/browser_usage_by_user?form.groupId=$click.value$&form.browserId=*&form.userId=*&form.monthVar.earliest=$monthVar.earliest$&form.monthVar.latest=$monthVar.latest$
          ]]>
    </link>
  </condition>
  <condition>
    <link>
      <![CDATA[
          /app/search/browser_usage_by_user?form.groupId=$click.value$&form.browserId=$click.name2$&form.userId=*&form.monthVar.earliest=$monthVar.earliest$&form.monthVar.latest=$monthVar.latest$
          ]]>
    </link>
  </condition>
</drilldown>

The crucial thing that I want to do is take $click.value$ and manipulate it (convert it back to groupId) prior to passing it to the next dashboard.

Is it possible to do this? Hopefully what I want to do makes sense. It's very similar to how a dropdown can have a "Label" and "Value" field on a dashboard.

Thanks!

0 Karma

sideview
SplunkTrust
SplunkTrust

Just for reference, this is a case that's probably easier and simpler if you were using the Sideview XML instead of the Simple XML, becaue you can simply use the hiddenFields param on the Table, and then refer to the hidden field in the Redirector with $click.fields.groupId$. You'd have to familiarize yourself with the Sideview Utils app and it's techniques by reading some of the docs and examples that ship with the app. http://sideviewapps.com/apps/sideview-utils

...other things here like your Pulldown/Textarea/Radio/Checkbox module(s), and the main Search...
<module name="Search">
  <param name="search">
  Message="BrowserLogging" Browser="$browserId$"
   | rename Data.GroupId as groupId 
   | lookup groupIdToName groupId 
   | chart count over groupName groupId by Browser
  </param>

  <module name="JobProgressIndicator"/>

  <module name="Pager">

    <module name="Table">
      <param name="hiddenFields">groupId</param>

      <module name="Redirector">
        <param name="url">/app/search/browser_usage_by_user</param>
        <param name="arg.form.groupId">$click.fields.groupId$</param>
        <param name="arg.form.browserId">*</param>
        <param name="arg.form.userId">*</param>
        <param name="arg.form.monthVar.earliest">$monthVar.earliest$</param>
        <param name="arg.form.monthVar.latest">$monthVar.latest$</param>
      </module>
    </module>
  </module>
</module>
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The same can be done in SimpleXML - output both columns in the table, refer to one column in the drilldown and hide the other column using CSS, something like this:

div#your_id table tr th:last-child, td:last-child {
  display: none;
}

Note though, chart count over A B by C is not valid. You'll need something like this instead:

... | eval group = groupName."###".groupId | chart count over foo by source | rex field=foo "(?<groupName>.*)###(?<groupId>.*)" | fields - foo | table groupName *
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could pass the groupName to the other dashboard and have that dashboard search by the groupId retrieved from that lookup of yours... that's assuming groupName to groupId is a 1:1 relationship.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...