All Apps and Add-ons

Drill down and drill up on 3 panels

nilaksh92
Path Finder

Hi Everyone,

Need you help resolve an issue.

Drill Down:-

I have one panel (Panel1) with a table, if I click on a cell of column1 then a token will be set with the value.

After that next panel will open (Panel2) which has same table with one extra column (column2) and panel2 will replace the Panel1.

If we click on a cell on column2 then again a token will be set with the value.

After which next panel will open (panel3) which has same table with one more extra column (column3). panel3 will replace panel2.

Note:- Token values is getting passed to next search.

Drill Up:-

Now I want to drill up in the same way as we drilled down,

Like if I click on any value of Column3, panel3 should get replace by panel2.

and if we click on any value of Column2 , panel2 should get replace by panel1.

Here I am able to drill down and facing issues with drill up.

Please help me out to solve this.

Thanks in advance.
Nikks

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi nilaksh92,

Please check below dashboard xml for "Drill Down" and "Drill Up" Logic.

As per your requirement.

Drill Down:-

On Click of "Panel 1 ->column 1", Panel 2 will show with Column 1 & Column 2 and Panel 1 will hide.

On Click of "Panel 2 ->column 2", Panel 3 will show with Column 1, Column 2 & Column 3 and Panel 2 will hide.

Drill Up:-

On Click of "Panel 3 ->column 3", Panel 2 will show with Column 1 & Column 2 and Panel 3 will hide.

On Click of "Panel 2 ->column 2", Panel 1 will show with Column 1 and Panel 2 will hide.

Here ,

Drill Down Of On Click of "Panel 2 ->column 2" is conflicting with Drill Up Of On Click of "Panel 2 ->column 2".

So I have changed in Drill Up of "Panel 2". Like,

On Click of "Panel 1 ->column 2", Panel 1 will show with Column 1 and Panel 2 will hide.

Code :

<dashboard>
  <label>DrillDown</label>
  <init>
    <set token="showPanel1"> </set>
    <unset token="showPanel2"></unset>
    <unset token="showPanel3"></unset>
  </init>
  <search id="mainsearch">
    <query>index="*" | stats count by index source sourcetype | rename index as "Column 1",source as "Column 2",sourcetype as "Column 3" </query>
    <earliest>-15m</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel depends="$showPanel1$">
      <title>Panel 1</title>
      <table>
        <search base="mainsearch">
          <query>table "Column 1"</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
         <drilldown>
          <condition field="Column 1">
            <unset token="showPanel1"> </unset>
            <set token="showPanel2"> </set>
            <unset token="showPanel3"> </unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showPanel2$">
      <title>Panel 2</title>
      <table>
        <search base="mainsearch">
          <query>table "Column 1" "Column 2"</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
           <condition field="Column 1">
            <set token="showPanel1"> </set>
            <unset token="showPanel2"></unset>
            <unset token="showPanel3"></unset>
          </condition>
          <condition field="Column 2">
            <unset token="showPanel1"></unset>
            <unset token="showPanel2"></unset>
            <set token="showPanel3"> </set>
          </condition>
          <condition field="*">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showPanel3$">
      <title>Panel 3</title>
      <table>
        <search base="mainsearch">
          <query>table "Column 1" "Column 2" "Column 3"</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="Column 3">
            <unset token="showPanel1"></unset>
            <set token="showPanel2"> </set>
            <unset token="showPanel3"></unset>
          </condition>
          <condition field="*">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

I hope it will help you to go ahead.

Thanks
Kamlesh

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi nilaksh92,

Please check below dashboard xml for "Drill Down" and "Drill Up" Logic.

As per your requirement.

Drill Down:-

On Click of "Panel 1 ->column 1", Panel 2 will show with Column 1 & Column 2 and Panel 1 will hide.

On Click of "Panel 2 ->column 2", Panel 3 will show with Column 1, Column 2 & Column 3 and Panel 2 will hide.

Drill Up:-

On Click of "Panel 3 ->column 3", Panel 2 will show with Column 1 & Column 2 and Panel 3 will hide.

On Click of "Panel 2 ->column 2", Panel 1 will show with Column 1 and Panel 2 will hide.

Here ,

Drill Down Of On Click of "Panel 2 ->column 2" is conflicting with Drill Up Of On Click of "Panel 2 ->column 2".

So I have changed in Drill Up of "Panel 2". Like,

On Click of "Panel 1 ->column 2", Panel 1 will show with Column 1 and Panel 2 will hide.

Code :

<dashboard>
  <label>DrillDown</label>
  <init>
    <set token="showPanel1"> </set>
    <unset token="showPanel2"></unset>
    <unset token="showPanel3"></unset>
  </init>
  <search id="mainsearch">
    <query>index="*" | stats count by index source sourcetype | rename index as "Column 1",source as "Column 2",sourcetype as "Column 3" </query>
    <earliest>-15m</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel depends="$showPanel1$">
      <title>Panel 1</title>
      <table>
        <search base="mainsearch">
          <query>table "Column 1"</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
         <drilldown>
          <condition field="Column 1">
            <unset token="showPanel1"> </unset>
            <set token="showPanel2"> </set>
            <unset token="showPanel3"> </unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showPanel2$">
      <title>Panel 2</title>
      <table>
        <search base="mainsearch">
          <query>table "Column 1" "Column 2"</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
           <condition field="Column 1">
            <set token="showPanel1"> </set>
            <unset token="showPanel2"></unset>
            <unset token="showPanel3"></unset>
          </condition>
          <condition field="Column 2">
            <unset token="showPanel1"></unset>
            <unset token="showPanel2"></unset>
            <set token="showPanel3"> </set>
          </condition>
          <condition field="*">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$showPanel3$">
      <title>Panel 3</title>
      <table>
        <search base="mainsearch">
          <query>table "Column 1" "Column 2" "Column 3"</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="Column 3">
            <unset token="showPanel1"></unset>
            <set token="showPanel2"> </set>
            <unset token="showPanel3"></unset>
          </condition>
          <condition field="*">
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

I hope it will help you to go ahead.

Thanks
Kamlesh

nilaksh92
Path Finder

Thanks Kamlesh.

I have done the same and able to resolve issue. Now problem is with switching time. It is taking much time while switching from one panel to other panel.

Can you help me on that.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Sure @nilaksh92,

quick questions:
- Are you using base search?
- For all 3 panel search, is all searches are different and independent from each other OR same?
- Are you passing First Panel's Cell value to 2nd Panel and/Or to 3rd Panel as token??

Thanks
Kamlesh

0 Karma

niketn
Legend

Since your question is around toggling token based on clicks and not around queries, can you put your current code with how you are using tokens to hide/show panels based on drilldown token. You can take out the Search queries and replace with mock query.

Following is an example to set token when one element is clicked once and unset when it is twice (not sure if you need toggle code or something else):

<drilldown>
    <condition match="$token1$==&quot;true&quot;">
         <unset token="token1"></unset>
    </condition>
    <condition>
         <set token="token1">true</set>
    </condition>
</drilldown>

Please provide more details as requested, if the above logic is not something/similar to you can use for your scenario.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nilaksh92
Path Finder

Hi,

Thanks for your response.

In my scenario, token values are getting passed from first query to the second and third query. So, above thing won't work for me.

Can we give Logical operators in depends and rejects attributes of panel?

0 Karma

niketn
Legend

If you share some mock code for query and code for your dashboard we would be able to assist.

If you have search setting the token, you can provide your search fieldName and compare previous value with current one as a sample below:

 <progress>
     <condition match="$token1$==&quot;$result.<fieldName>$&quot;">
          <unset token="token1"></unset>
     </condition>
     <condition>
          <set token="token1">$result.<fieldName>$</set>
     </condition>
 </progress>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

PS: progress (or done) search event handler will work on 6.5 onwards, prior to 6.4 it was preview (or finalized).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...