How to create a drilldown for a single value chart to display a timechart panel?

[dbcase]

Hi,

I have a single value chart that shows the count of successful logins for x period of time. I'd like to be able to click on the number and display a timechart panel that shows the login ID and when they logged in. Is this possible?

The existing query I have is:

index=cox sourcetype=wls_managedserver |rex field=message_text "X-login:\s(?< Login >[^\s\:;]+)"|timechart span=1hr count(Login) as "Login Count"

This works just fine. Just having trouble defining a subsequent drilldown on a dashboard

[somesoni2 · Accepted solution]

Follow instructions from this

https://answers.splunk.com/answers/369155/how-to-create-a-drilldown-for-a-single-value-panel.html

[dbcase]

Thanks! That gets very close. Since I'm not especially skilled at XML I think I need to modify this line

< option name="linkView" >YourSecondDashboard< /option >

But I don't know what I need to modify it to in order to call an in dashboard, not visible (got this one) panel.

[somesoni2]

I think you're looking for an in-page drilldown ( the timechart to be shown on the same dashboard), so try like this

<row>
   <panel>
      <single>
         <title>Single Value Drilldown</title>
         <search>
           <query>index=_internal | stats count</query>
           <earliest>$timerange.earliest$</earliest>
           <latest>$timerange.latest$</latest>
         </search>
         <option name="drilldown">all</option>
         <option name="afterLabel">Click Here</option>
         <option name="underLabel">OR Click Here</option>
         <option name="linkFields">underlabel, afterlabel</option>
         <drilldown>
            <set  token="showtimechart">y</set>
         <drilldown>
       </single>
   </panel>
</row>
<row>
   <panel depends="$showtimechart$">
      <chart>
         <title>Single Value Drilldown</title>
         <search>
           <query>Your timechart search</query>
           <earliest>$timerange.earliest$</earliest>
           <latest>$timerange.latest$</latest>
         </search>
         ----other options----
       </chart >
   </panel>
</row>

[dbcase]

Thanks somesoni2!

Worked great!!!! Had to add < /drilldown> but other than that it did exactly what was needed! Thank you!!!

[s2_splunk]

I recommend you download the Splunk 6.x Dashboard examples app and take a look at the single value drilldown example in there. That should get you where you want to go.