Dashboards & Visualizations

How to create an inline drilldown where clicking on a row in the table populates a drop-down form with 3 values?

stephane_cyrill
Builder

What I want to do is to change the status value with values from the a drop-down or textbox and display an upgraded drilldown page.

The following is my XML code with in page drilldown.

THE PROBLEM IS HOW TO ADD INPUTS ON THE DRILLDOWN PAGE.

Thanks in advance for your help.



     <input type="time" searchWhenChanged="true">
      <label>Select a time:</label>
      <default>Last 24 hours</default>
    </input>


    <input type="multiselect" token="status" searchWhenChanged="true">
     <label>Select a status:</label>
      <default>ALL</default>
        <!-- The final value will be surrounded by prefix and suffix -->
        <prefix>(</prefix>
        <suffix>)</suffix>
        <!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
        <valuePrefix>status="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
        <delimiter> OR </delimiter>

        <populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="status" fieldForValue="status">index=ticket |stats count by status | eval Label=status</populatingSearch>
     </input>  

     <input type="multiselect" token="host" searchWhenChanged="true">
      <label>Select a host:</label>
      <default>ALL</default>

        <!-- The final value will be surrounded by prefix and suffix -->
        <prefix>(</prefix>
        <suffix>)</suffix>
        <!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
        <valuePrefix>host="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
        <delimiter> OR </delimiter>
        <choice value="*">ALL</choice>
        <populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="host" fieldForValue="host">index=ticket |stats count by host| eval Label=host</populatingSearch>
     </input>

    <input type="text" token="TicketNumber" searchWhenChanged="true">
      <label>Enter a TicketNumber :</label>   
    </input>

  </fieldset>

  <row>

      <table id="master">
        <title>Table_of_the_alert </title>
        <searchString>index=ticket |eval TicketNumber=round(_time) |eval Raw=_raw | table TicketNumber _time host status source Raw app</searchString>

        <option name="drilldown">row</option>
            <drilldown>
                <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
                <set token="TicketNumber">$row.TicketNumber$</set>
                <!-- If we also set the form.User the input will get updated too -->
                <set token="form.TicketNumber">$row.TicketNumber$</set>
            </drilldown>
      </table>

  </row>



    <fieldset submitButton="true" autoRun="true">
     <input type="dropdown" token="status" searchWhenChanged="true">
      <label>Status</label>
      <choice value="&quot;*&quot;">All</choice>
      <default>"*"</default>
      <populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="Label" fieldForValue="status">index=ticket |stats count by status | eval Label=status</populatingSearch>
    </input>

     <input type="text" token="comment" searchWhenChanged="true">
      <label>Enter a Name of the comments :</label>   
    </input>
   </fieldset>

    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <table id="detail" depends="$TicketNumber$">
            <title>the events of this User for other files: $TicketNumber$</title>
            <searchTemplate>index=ticket $TicketNumber$ |table status source _raw </searchTemplate>

        </table>
    </row>


</form>
0 Karma

gyslainlatsa
Motivator

hi,
try this

<form>
  <label>SPLUNK MULTI-SELECT INPUT</label>

  <fieldset submitButton="false" autoRun="true">

     <input type="time" searchWhenChanged="true">
      <label>Select a time:</label>
      <default>Last 24 hours</default>
    </input>


    <input type="multiselect" token="status" searchWhenChanged="true">
     <label>Select a status:</label>
     <choice value="*">ALL</choice>
      <default>*</default>
        <!-- The final value will be surrounded by prefix and suffix -->
        <prefix>(</prefix>
        <suffix>)</suffix>
        <!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
        <valuePrefix>status="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
        <delimiter> OR </delimiter>
        <choice value="Open">open</choice>
        <choice value="Closed">Closed</choice>
        <choice value="Inprogress">In progress</choice>

        <populatingSearch earliest="0" latest="now" fieldForLabel="status" fieldForValue="status">index=ticket |stats count by status | eval Label=status</populatingSearch>
     </input>  

     <input type="multiselect" token="host" searchWhenChanged="true">
      <label>Select a host:</label>
      <choice value="*">ALL</choice>
      <default>*</default>

        <!-- The final value will be surrounded by prefix and suffix -->
        <prefix>(</prefix>
        <suffix>)</suffix>
        <!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
        <valuePrefix>host="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
        <delimiter> OR </delimiter>

        <populatingSearch earliest="0" latest="now" fieldForLabel="host" fieldForValue="host">index=ticket |stats count by host| eval Label=host</populatingSearch>
     </input>

    <input type="text" token="TicketNumber" searchWhenChanged="true">
      <label>Enter a TicketNumber :</label>   
    </input>

  </fieldset>



  <row>

    <panel>

      <table>
        <title>Table_of_the_alert </title>
        <search>
          <query>index=ticket report="ticket1" $host$ $status$ |table TicketNumber Alerttime status host Raw Comments</query>    
        </search>

        <option name="drilldown">row</option>
            <drilldown>
                <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
                <set token="TicketNumber">$row.TicketNumber$</set>
                <!-- If we also set the form.User the input will get updated too -->
                <set token="form.TicketNumber">$row.TicketNumber$</set>
            </drilldown>
      </table>

  </panel>

  <panel id="detail" depends="$TicketNumber$">

     <input type="dropdown" token="status" searchWhenChanged="true">
      <label>Status</label>
      <choice value="Open">open</choice>
      <choice value="Closed">Closed</choice>
      <choice value="Inprogress">In progress</choice>
      <choice value="*">All</choice>
      <default>*</default>
      <populatingSearch earliest="0" latest="now" fieldForLabel="Label" fieldForValue="status">index=ticket |stats count by status | eval Label=status</populatingSearch>
    </input>

     <input type="text" token="comment" searchWhenChanged="true">
      <label>Enter your comments :</label>   
    </input>

        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->

        <table>
            <title>the events of this User for other files: $TicketNumber$</title>
            <searchTemplate>index=ticket report="ticket1" $TicketNumber$ |table Alerttime status Raw Comments</searchTemplate>

        </table>

    </panel>

   </row>

</form>
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...