All Apps and Add-ons

Treemap: How to open a search using drilldown when clicked/zoomed on parent rectangle?

sohaibomar
Explorer

I was able to open a search using drilldown when clicked on child rectangle of tree maps as mentioned in official documentation here
http://docs.splunk.com/Documentation/Treemap/1.1.1/TreemapViz/TreeMapComponents

But I need to open a search when parent category is Zoomed/Clicked, so far I have tried below code but it doesn't pass the token until clicked on children rectangle.

<form>
  <label>treemaps drilldown</label>
    <row>
    <panel>
      <title>treemap</title>
      <viz type="treemap_app.treemap">
        <search>
          <query>sourcetype="syslog"| stats sum(traffic) by category, application</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="drilldown">all</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="category">$row.category$</set>
        </drilldown>

      </viz>
    </panel>
    <panel depends="$category$">
      <chart>
        <title>Top Applications of Category $category$ </title>
        <search>
          <query>sourcetype="syslog" category=$category$| top application</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

Is it possible to use drilldown when clicked on parent rectangle in treemaps?

cmerriman
Super Champion

Unfortunately, Treemap doesn't support drilldowns until you reach the child level. Generally it would open in search, unless you defined a drilldown behavior. From looking at your code, it should be picking up the parent category and using that in your second search. I understand it is more of an inconvenience to the users, but I don't think there is a way around it unless you were to customize the treemap code itself.

sohaibomar
Explorer

Yeah, seems legit.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...