Dashboards & Visualizations

How can I drilldown values from a hidden field?

pamcarvalho
Path Finder

Hey!

I am building a dashboard and this problem is being a headache. I really need to find a way to drilldown values from hidden fields and/or panels, but not sure how to do so.. Can anyone help me, please?
Thanks in advance!

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

Based on your comments, what you might be looking for is something like this:

<table>
  <search>
    <query>data=A | table info date</query>
  </search>
  <drilldown>
    <eval token="drilldown_token">strftime(strptime('row.date', "%F"), "%d.%m.%Y")</eval>
  </drilldown>
</table>
...
<table depends="$drilldown_token$">
  <search>
    <query>data=B | search other_date="$drilldown_token$"</query>
  </search>
</table>

This allows you to have a value passed to the drilldown that is not visible in the table you drilled down from. In the case above, imagine having a date like "2017-10-19" in the table you drill down from while you need it as "19.10.2017" in your target search.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

Based on your comments, what you might be looking for is something like this:

<table>
  <search>
    <query>data=A | table info date</query>
  </search>
  <drilldown>
    <eval token="drilldown_token">strftime(strptime('row.date', "%F"), "%d.%m.%Y")</eval>
  </drilldown>
</table>
...
<table depends="$drilldown_token$">
  <search>
    <query>data=B | search other_date="$drilldown_token$"</query>
  </search>
</table>

This allows you to have a value passed to the drilldown that is not visible in the table you drilled down from. In the case above, imagine having a date like "2017-10-19" in the table you drill down from while you need it as "19.10.2017" in your target search.

pamcarvalho
Path Finder

Yes!!!! That's it! Thank you very much!

0 Karma

pamcarvalho
Path Finder

Just an update, this wasn't working for me but I found a way to do it, so in case that helps anyone, this is what I did:

<drilldown>
          <eval token="EOEDDE">strftime('earliest',"%d/%m/%y")</eval>
          <eval token="EOEDDL">strftime('latest',"%d/%m/%y")</eval>
          <set token="EOEDD">$earliest$</set>
          <set token="EOLDD">$latest$</set>
</drilldown>

I used "EOEDDE" and "EOEDDL" for the panel title. "EOEDD" and "EOLDD" to generate results to a table.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi pamcarvalho,
create your search, e.g.:

index=my_index
| table _time field1 field2 hidden_field

in the panel options put the tag

<fields>_time,field1,field2</fields>

then in drilldown you can use hidden_field

Bye.
Giuseppe

pamcarvalho
Path Finder

But that only works assuming that someone clicks on the table right? Is there a way do display the field value without depending on that?

0 Karma

pamcarvalho
Path Finder

For example, a hidden panel that has a table with only one field value. Is it possible to drilldown this value?

0 Karma

gcusello
SplunkTrust
SplunkTrust

a drilldown starts always from a click on a Splunk object!
Do you want to automatically open a dashboard from another one?
Why?
bye.
Giuseppe

0 Karma

pamcarvalho
Path Finder

No, l want to drilldown a value, change its format and then drilldown the new value. But the intermediary value shouldn't show up.. Not sure if I made myself clear..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...