All Apps and Add-ons

Treemap: How to open a search using drilldown when clicked/zoomed on parent rectangle?

sohaibomar
Explorer

I was able to open a search using drilldown when clicked on child rectangle of tree maps as mentioned in official documentation here
http://docs.splunk.com/Documentation/Treemap/1.1.1/TreemapViz/TreeMapComponents

But I need to open a search when parent category is Zoomed/Clicked, so far I have tried below code but it doesn't pass the token until clicked on children rectangle.

<form>
  <label>treemaps drilldown</label>
    <row>
    <panel>
      <title>treemap</title>
      <viz type="treemap_app.treemap">
        <search>
          <query>sourcetype="syslog"| stats sum(traffic) by category, application</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="drilldown">all</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="category">$row.category$</set>
        </drilldown>

      </viz>
    </panel>
    <panel depends="$category$">
      <chart>
        <title>Top Applications of Category $category$ </title>
        <search>
          <query>sourcetype="syslog" category=$category$| top application</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

Is it possible to use drilldown when clicked on parent rectangle in treemaps?

cmerriman
Super Champion

Unfortunately, Treemap doesn't support drilldowns until you reach the child level. Generally it would open in search, unless you defined a drilldown behavior. From looking at your code, it should be picking up the parent category and using that in your second search. I understand it is more of an inconvenience to the users, but I don't think there is a way around it unless you were to customize the treemap code itself.

sohaibomar
Explorer

Yeah, seems legit.

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...