Dashboards & Visualizations

Does Splunk Drilldown actually work?

yiguanghu
Explorer

I have a stats that shows count of several columns by _time. It shows the timeline and table correctly. But when I clicked the green bar to drill down, It always show 0 results. Please let me know what am I missing?

Tags (2)
0 Karma

yiguanghu
Explorer

Looks like drilldown works ok on single source searches. My situation is the search contains two sources joined together throgh different columns using eval and sub search as following:

source="sample1.csv"| eval joinid=if(isnotnull(key), key, "Incident") | join joinid [search source="sample2.csv"| eval joinid=if(isnotnull(Key), Key, "Jira")] | bucket _time span=1h | stats count as incidents, count(Key) as jiras, count(Issue_Links) as clonedjira by _time

Anyway can drill down from on this search?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...