Dashboards & Visualizations

Condition value using a drilldown

dbcase
Motivator

Ok stumped (again......)

I have this drilldown code

<!-- Begin the conditional drill down -->
        <drilldown>
          <condition field="Trend">
            <unset token="tablevalue"></unset>
          </condition>
          <condition field="Current Cell Connectivity %">
            <unset token="tablevalue"></unset>
          </condition>
          <condition field="*">
            <set token="tablevariable">$click.value2$</set>
          </condition>
          <condition value="Cox Home Life - CHL">
            <set token="s_mso">Cox</set>
          </condition>
          <condition value="Cox Business Security Solutions - CBSS">
            <set token="s_mso">Coxsmb</set>
          </condition>
        </drilldown>
        <!-- End the conditional drill down -->

And the resulting chart

chart depends="$tablevariable$">
        <title>Expanded Cell Connectivity for - $tablevariable$</title>
        <search>
          <query>index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell"  |where mso=lower("$s_mso$") | eval stat_val=round(stat_val,2)| timechart  first(stat_val) as "Cell Connectivity"|</query>
          <earliest>0</earliest>
        </search>

What I'm hoping to do is this:

If the value in the table is Cox Home Life - CHL, set the $s_mso$ token to "Cox" and then in the query search where s_mso="Cox" (there is some upper to lowercase conversion there, but let's ignore that for now as I know it works)

The problem is that the chart never appears, it simply says Search is waiting for data. The only thing I can think of is that the token tablevariable isn't getting set but it should be due to the user click selection in the row.

0 Karma
1 Solution

sundareshr
Legend

First let me say that you do a fantastic job commenting your code. Even in dashboards 🙂

I think, the reason you don't see the chart is because the token tablevariable doesn't get set unless the first two conditions fail. In other words, if condition field=Trend OR field="Current Cell Connectivity %" is met, the third, fourth fifth, etc will not be met. Try adding tablevariable to all conditions, like this

*UPDATED*

 <drilldown>
     <condition field="MSO - Click for Expanded View">
         <set token="tablevariable">$click.value2$</set>
         <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL", "Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
     </condition>
     <condition field="*">
         <unset token="tablevariable"></unset>
     </condition>
 </change>
 </drilldown>

View solution in original post

0 Karma

sundareshr
Legend

First let me say that you do a fantastic job commenting your code. Even in dashboards 🙂

I think, the reason you don't see the chart is because the token tablevariable doesn't get set unless the first two conditions fail. In other words, if condition field=Trend OR field="Current Cell Connectivity %" is met, the third, fourth fifth, etc will not be met. Try adding tablevariable to all conditions, like this

*UPDATED*

 <drilldown>
     <condition field="MSO - Click for Expanded View">
         <set token="tablevariable">$click.value2$</set>
         <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL", "Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
     </condition>
     <condition field="*">
         <unset token="tablevariable"></unset>
     </condition>
 </change>
 </drilldown>
0 Karma

dbcase
Motivator

Awwww making me blush 🙂 If I didn't document I would be even more lost than I am today!!! 🙂

On the updated code I realized that I had tablevalue instead of tablevariable so I fixed that.

I only want tablevariable to be set if the user clicks on the first column so I guess I can rework that to make it simpler. I'll do that and post the update (maybe it will work -- fingers crossed)

0 Karma

dbcase
Motivator

Updated code

<!-- Begin the conditional drill down -->
        <drilldown>
          <condition field="MSO - Click for Expanded View">
            <set token="tablevariable">$click.value2$</set>
          </condition>
          <condition field="*">
            <unset token="tablevariable"></unset>
          </condition>

          <change>
          <condition tablevariable="Cox Home Life - CHL">
            <set token="s_mso">Cox</set>
          </condition>
          <condition tablevariable="Cox Business Security Solutions - CBSS">
            <set token="s_mso">Coxsmb</set>
          </condition>
          </change>
        </drilldown>
0 Karma

sundareshr
Legend

See if this works

<drilldown>
    <condition field="MSO - Click for Expanded View">
        <set token="tablevariable">$click.value2$</set>
        <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
    </condition>
    <condition field="*">
        <unset token="tablevariable"></unset>
    </condition>
</change>
</drilldown>
0 Karma

dbcase
Motivator

Hmmm I think you are close!

Cox Home Life - CHL should equal to "Cox"
Cox Business Security Solutions - CBSS should equal to "CBSS"

I tried poking around with the case statement to make that work but alas.... I made it NOT work 🙂

0 Karma

sundareshr
Legend

I updated the original answer, try that

0 Karma

dbcase
Motivator

Still no joy 😞

I included s_mso in the chart header.

Here is what it reads

Expanded Cell Connectivity for - Cox Home Life - CHL *

s_mso is getting set to *

0 Karma

dbcase
Motivator

Found it!!!! Removing the quotes from around $click.value2$ worked!

<eval token="s_mso">case($click.value2$="Cox Home Life - CHL", "Cox", $click.value2$="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>     </condition>

dbcase
Motivator

This is the update I tried

         <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL","Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
0 Karma

dbcase
Motivator

It seems like s_mso is getting set to *

0 Karma

dbcase
Motivator

A bit more info, if I remove where mso="$s_mso$" from the expanded query it shows the chart. The values are incorrect but the chart shows. Something about the s_mso token isn't quite right but for the life of me I can't see it.

0 Karma

dbcase
Motivator

Updated drilldown code (still no joy)

<!-- Begin the conditional drill down -->
        <drilldown>
          <condition field="Trend">
            <unset token="tablevariable"></unset>
          </condition>
          <condition field="Current Cell Connectivity %">
            <unset token="tablevariable"></unset>
          </condition>
          <condition field="*">
            <set token="tablevariable">$click.value2$</set>
          </condition>
          <condition tablevariable="Cox Home Life - CHL">
            <set token="s_mso">Cox</set>
          </condition>
          <condition tablevariable="Cox Business Security Solutions - CBSS">
            <set token="s_mso">Coxsmb</set>
          </condition>
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...