Splunk Search

Reset map drilldown

rvisj
New Member

I have created map in dashboard. Initially a Bar chart appears having data of all states. Drill down on map is applied, as a result, bar chart shows particular state data. But how can I go back to data of 'All states' in bar chart after done with particular state data.

alt text

Tags (3)
0 Karma
1 Solution

nilaksh92
Path Finder

Hi,

You have two panels, right? Below is sample code for the 3 panel drilldown, you can use this as your reference.

 <dashboard>
   <label>DrillDown</label>
   <init>
     <set token="showPanel1"> </set>
     <unset token="showPanel2"></unset>
     <unset token="showPanel3"></unset>
   </init>
   <search id="mainsearch">
     <query>index="*" | stats count by index source sourcetype | rename index as "Column 1",source as "Column 2",sourcetype as "Column 3" </query>
     <earliest>-15m</earliest>
     <latest>now</latest>
     <sampleRatio>1</sampleRatio>
   </search>
   <row>
     <panel depends="$showPanel1$">
       <title>Panel 1</title>
       <table>
         <search base="mainsearch">
           <query>table "Column 1"</query>
         </search>
         <option name="count">20</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
          <drilldown>
           <condition field="Column 1">
             <unset token="showPanel1"> </unset>
             <set token="showPanel2"> </set>
             <unset token="showPanel3"> </unset>
           </condition>
         </drilldown>
       </table>
     </panel>
   </row>
   <row>
     <panel depends="$showPanel2$">
       <title>Panel 2</title>
       <table>
         <search base="mainsearch">
           <query>table "Column 1" "Column 2"</query>
         </search>
         <option name="count">20</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
         <drilldown>
            <condition field="Column 1">
             <set token="showPanel1"> </set>
             <unset token="showPanel2"></unset>
             <unset token="showPanel3"></unset>
           </condition>
           <condition field="Column 2">
             <unset token="showPanel1"></unset>
             <unset token="showPanel2"></unset>
             <set token="showPanel3"> </set>
           </condition>
           <condition field="*">
           </condition>
         </drilldown>
       </table>
     </panel>
   </row>
   <row>
     <panel depends="$showPanel3$">
       <title>Panel 3</title>
       <table>
         <search base="mainsearch">
           <query>table "Column 1" "Column 2" "Column 3"</query>
         </search>
         <option name="count">20</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
         <drilldown>
           <condition field="Column 3">
             <unset token="showPanel1"></unset>
             <set token="showPanel2"> </set>
             <unset token="showPanel3"></unset>
           </condition>
           <condition field="*">
           </condition>
         </drilldown>
       </table>
     </panel>
   </row>
 </dashboard>

Thanks
Nikks

View solution in original post

0 Karma

nilaksh92
Path Finder

Hi,

You have two panels, right? Below is sample code for the 3 panel drilldown, you can use this as your reference.

 <dashboard>
   <label>DrillDown</label>
   <init>
     <set token="showPanel1"> </set>
     <unset token="showPanel2"></unset>
     <unset token="showPanel3"></unset>
   </init>
   <search id="mainsearch">
     <query>index="*" | stats count by index source sourcetype | rename index as "Column 1",source as "Column 2",sourcetype as "Column 3" </query>
     <earliest>-15m</earliest>
     <latest>now</latest>
     <sampleRatio>1</sampleRatio>
   </search>
   <row>
     <panel depends="$showPanel1$">
       <title>Panel 1</title>
       <table>
         <search base="mainsearch">
           <query>table "Column 1"</query>
         </search>
         <option name="count">20</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
          <drilldown>
           <condition field="Column 1">
             <unset token="showPanel1"> </unset>
             <set token="showPanel2"> </set>
             <unset token="showPanel3"> </unset>
           </condition>
         </drilldown>
       </table>
     </panel>
   </row>
   <row>
     <panel depends="$showPanel2$">
       <title>Panel 2</title>
       <table>
         <search base="mainsearch">
           <query>table "Column 1" "Column 2"</query>
         </search>
         <option name="count">20</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
         <drilldown>
            <condition field="Column 1">
             <set token="showPanel1"> </set>
             <unset token="showPanel2"></unset>
             <unset token="showPanel3"></unset>
           </condition>
           <condition field="Column 2">
             <unset token="showPanel1"></unset>
             <unset token="showPanel2"></unset>
             <set token="showPanel3"> </set>
           </condition>
           <condition field="*">
           </condition>
         </drilldown>
       </table>
     </panel>
   </row>
   <row>
     <panel depends="$showPanel3$">
       <title>Panel 3</title>
       <table>
         <search base="mainsearch">
           <query>table "Column 1" "Column 2" "Column 3"</query>
         </search>
         <option name="count">20</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
         <drilldown>
           <condition field="Column 3">
             <unset token="showPanel1"></unset>
             <set token="showPanel2"> </set>
             <unset token="showPanel3"></unset>
           </condition>
           <condition field="*">
           </condition>
         </drilldown>
       </table>
     </panel>
   </row>
 </dashboard>

Thanks
Nikks

0 Karma

rvisj
New Member

thanks @nilaksh, It gives a hint

0 Karma

nilaksh92
Path Finder

Hi

If it helped you,please accept the answer and give some award points 🙂

Thanks
Nikks

0 Karma

nilaksh92
Path Finder

Hi

You can try below command under drill down tag

<unset token="abc"></unset>

Thanks
Nikks

0 Karma

rvisj
New Member

HI Nikks,

<set token="State">$click.value$</set>

this is what I added under drill down , to get values of clicked state. I don't think unsetting token there, would make any sense.

0 Karma

cmerriman
Super Champion

try adding something like this to the dashboard. you'll need to fill in the token you've created for the drilldown (i've just put in STATETOKEN:

  <row>
    <panel>
      <html>
        <button class="btn" data-unset-token="STATETOKEN">Reset Drilldown</button>
      </html>
    </panel>
  </row>

this little html bit can be nestled into the panel with the bar chart or map if you want, or you can keep it as a separate panel. you can also use a depends statement to have it only show when the drilldown has been applied.

rvisj
New Member

I think we need little bit of JavaScript to make it work. Even after that if I unset token also, the bar chart will show 'waiting for input'. As my chart query is:

/source/ |where state="$State$"|chart count by Product

0 Karma

cmerriman
Super Champion

here is a sample of how i have it working in one of my own dashboards, no JS required. This syntax replaced the "My Title" panel with the "My New Title" panel when you click on something to drilldown. After clicking "Reset Drilldown", the original table/panel is restored. :

...
<row>
    <panel depends="$input1$" rejects="$newtoken$">
      <title>My Title</title>
      <table>
        <search>
          <query>........</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        </format>
        <drilldown>
          <set token="newtoken">$click.value2$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html depends="$newtoken$">
         <button class="btn" data-unset-token="newtoken">Reset Drilldown</button>
     </html>
      <table depends="$newtoken$">
        <title>New Table Title</title>
        <search>
          <query>.......</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
...
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...