Dashboards & Visualizations

Condition value using a drilldown

dbcase
Motivator

Ok stumped (again......)

I have this drilldown code

<!-- Begin the conditional drill down -->
        <drilldown>
          <condition field="Trend">
            <unset token="tablevalue"></unset>
          </condition>
          <condition field="Current Cell Connectivity %">
            <unset token="tablevalue"></unset>
          </condition>
          <condition field="*">
            <set token="tablevariable">$click.value2$</set>
          </condition>
          <condition value="Cox Home Life - CHL">
            <set token="s_mso">Cox</set>
          </condition>
          <condition value="Cox Business Security Solutions - CBSS">
            <set token="s_mso">Coxsmb</set>
          </condition>
        </drilldown>
        <!-- End the conditional drill down -->

And the resulting chart

chart depends="$tablevariable$">
        <title>Expanded Cell Connectivity for - $tablevariable$</title>
        <search>
          <query>index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell"  |where mso=lower("$s_mso$") | eval stat_val=round(stat_val,2)| timechart  first(stat_val) as "Cell Connectivity"|</query>
          <earliest>0</earliest>
        </search>

What I'm hoping to do is this:

If the value in the table is Cox Home Life - CHL, set the $s_mso$ token to "Cox" and then in the query search where s_mso="Cox" (there is some upper to lowercase conversion there, but let's ignore that for now as I know it works)

The problem is that the chart never appears, it simply says Search is waiting for data. The only thing I can think of is that the token tablevariable isn't getting set but it should be due to the user click selection in the row.

0 Karma
1 Solution

sundareshr
Legend

First let me say that you do a fantastic job commenting your code. Even in dashboards 🙂

I think, the reason you don't see the chart is because the token tablevariable doesn't get set unless the first two conditions fail. In other words, if condition field=Trend OR field="Current Cell Connectivity %" is met, the third, fourth fifth, etc will not be met. Try adding tablevariable to all conditions, like this

*UPDATED*

 <drilldown>
     <condition field="MSO - Click for Expanded View">
         <set token="tablevariable">$click.value2$</set>
         <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL", "Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
     </condition>
     <condition field="*">
         <unset token="tablevariable"></unset>
     </condition>
 </change>
 </drilldown>

View solution in original post

0 Karma

sundareshr
Legend

First let me say that you do a fantastic job commenting your code. Even in dashboards 🙂

I think, the reason you don't see the chart is because the token tablevariable doesn't get set unless the first two conditions fail. In other words, if condition field=Trend OR field="Current Cell Connectivity %" is met, the third, fourth fifth, etc will not be met. Try adding tablevariable to all conditions, like this

*UPDATED*

 <drilldown>
     <condition field="MSO - Click for Expanded View">
         <set token="tablevariable">$click.value2$</set>
         <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL", "Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
     </condition>
     <condition field="*">
         <unset token="tablevariable"></unset>
     </condition>
 </change>
 </drilldown>
0 Karma

dbcase
Motivator

Awwww making me blush 🙂 If I didn't document I would be even more lost than I am today!!! 🙂

On the updated code I realized that I had tablevalue instead of tablevariable so I fixed that.

I only want tablevariable to be set if the user clicks on the first column so I guess I can rework that to make it simpler. I'll do that and post the update (maybe it will work -- fingers crossed)

0 Karma

dbcase
Motivator

Updated code

<!-- Begin the conditional drill down -->
        <drilldown>
          <condition field="MSO - Click for Expanded View">
            <set token="tablevariable">$click.value2$</set>
          </condition>
          <condition field="*">
            <unset token="tablevariable"></unset>
          </condition>

          <change>
          <condition tablevariable="Cox Home Life - CHL">
            <set token="s_mso">Cox</set>
          </condition>
          <condition tablevariable="Cox Business Security Solutions - CBSS">
            <set token="s_mso">Coxsmb</set>
          </condition>
          </change>
        </drilldown>
0 Karma

sundareshr
Legend

See if this works

<drilldown>
    <condition field="MSO - Click for Expanded View">
        <set token="tablevariable">$click.value2$</set>
        <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
    </condition>
    <condition field="*">
        <unset token="tablevariable"></unset>
    </condition>
</change>
</drilldown>
0 Karma

dbcase
Motivator

Hmmm I think you are close!

Cox Home Life - CHL should equal to "Cox"
Cox Business Security Solutions - CBSS should equal to "CBSS"

I tried poking around with the case statement to make that work but alas.... I made it NOT work 🙂

0 Karma

sundareshr
Legend

I updated the original answer, try that

0 Karma

dbcase
Motivator

Still no joy 😞

I included s_mso in the chart header.

Here is what it reads

Expanded Cell Connectivity for - Cox Home Life - CHL *

s_mso is getting set to *

0 Karma

dbcase
Motivator

Found it!!!! Removing the quotes from around $click.value2$ worked!

<eval token="s_mso">case($click.value2$="Cox Home Life - CHL", "Cox", $click.value2$="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>     </condition>

dbcase
Motivator

This is the update I tried

         <eval token="s_mso">case("$click.value2$"="Cox Home Life - CHL","Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"</eval>
0 Karma

dbcase
Motivator

It seems like s_mso is getting set to *

0 Karma

dbcase
Motivator

A bit more info, if I remove where mso="$s_mso$" from the expanded query it shows the chart. The values are incorrect but the chart shows. Something about the s_mso token isn't quite right but for the life of me I can't see it.

0 Karma

dbcase
Motivator

Updated drilldown code (still no joy)

<!-- Begin the conditional drill down -->
        <drilldown>
          <condition field="Trend">
            <unset token="tablevariable"></unset>
          </condition>
          <condition field="Current Cell Connectivity %">
            <unset token="tablevariable"></unset>
          </condition>
          <condition field="*">
            <set token="tablevariable">$click.value2$</set>
          </condition>
          <condition tablevariable="Cox Home Life - CHL">
            <set token="s_mso">Cox</set>
          </condition>
          <condition tablevariable="Cox Business Security Solutions - CBSS">
            <set token="s_mso">Coxsmb</set>
          </condition>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...