Drilldown with column value when clicking on any row.

[amerineni]

Hello, I want to mimic a cell click even if we click anywhere in the row.

my query: ----- | table type, operationOrURI, status, channel, flow, deviceId, workflowId, identifier, timeStamp

<option name="drilldown">row</option>
        <drilldown>
           <condition field="*">
             <set token="operationOrURI">$row.operationOrURI$</set>
           </condition>
        </drilldown>

In this table i want to always pass "operationOrURI" no matter where the user clicks on that row. Click is not working with the above code. Appreciate for any help.

[niketn · Accepted solution]

@amerineni, just get rid of <condition> block and it should work the way you expect:

     <drilldown>
          <set token="operationOrURI">$row.operationOrURI$</set>
     </drilldown>

[amerineni]

Did the same, but same response. Nothing is happening when i click.

row

$row.operationOrURI$

[niketn]

Following is run anywhere dashboard with two sample rows. You can click and column in the two rows (keep switching between first row and second to see a change in token $operationOrURI$)

<dashboard>
  <label>Drilldown Field Value</label>
  <row>
    <panel>
      <title>Clicked Row Token operationOrURI Value: $operationOrURI$</title>
      <table>
        <search>
          <query>|  makeresults
|  eval type="type1", operationOrURI="operation", status=200
|  table type, operationOrURI, status
|  append 
    [|  makeresults
|  eval type="type2", operationOrURI="URI", status=404
|  table type, operationOrURI, status]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="operationOrURI">$row.operationOrURI$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

If this does not solve what you are looking for then please add few rows of sample data (don't forget to mock up/anonymize sensitive information) for fields type, operationOrURI, status, channel, flow, deviceId, workflowId, identifier, timeStamp. This will help us assist you better.

[amerineni]

Thanks for the quick response. Below is sample data. Its wierd that nothing is happening when i click with drilldown set token tag. Also why is your drilldown option set to "cell" instead of "row"

REQUEST_METRIC /shopping/continueToDeviceValidation S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:16:01
SERVICE_METRIC verifyAccountUnchanged S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:16:01
REQUEST_METRIC /shopping/showAccessoryCatalog S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:19:07
REQUEST_METRIC /upgrades/upgrade S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:20:47
PERFORMANCE PERFORMANCE NA CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:20:47
SERVICE_METRIC GetEligibleSalesScenarios S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:20:47

[niketn]

cell or row does not matter for the example. You can change to row if you want.
Can you add the data from the output of table command? That way it will be easier for me to look at what are the values of operationOrURI field.

Have you tried token filters like <set token="operationOrURI">$row.operationOrURI|s$</set> for escaping the value as string.

Have you displayed $operationOrURI$ somewhere like I am displaying in <panel> <title>? What value does it show when you click a row?

[amerineni]

looks like i can't upload image here. Here is the link to the image.

https://photos.app.goo.gl/9hmRTGvhSuKtCBqZ2

The data i gave above is from table output.
When i click the row nothing is happening. No response.

[niketn]

Have you printed the token you are setting in the drilldown to test? Does it remain empty and keep showing up $row.operationOrURI$ even if you click on table row any where?Can you also add your existing drilldown code? Are you using drilldown to link to other dashboard or set a token?

You would require to make token value safe to be used as URL in case you are using <link> and not <set>: $row.operationOrURI|u$

http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters

Following is the updated Run Anywhere Dashboard with mocked up data as per your screenshot. You can see the token is being set as expected. Please do share how you are trying to utilize the token afterwards.

<dashboard>
  <label>Drilldown Field Value</label>
  <row>
    <panel>
      <title>Clicked Row Token operationOrURI Value: $operationOrURI$</title>
      <table>
        <search>
          <query>|  makeresults
|  eval "Event Type"="REQUEST_METRICS", operationOrURI="/shipping/continnueToPayment", status="S"
|  table "Event Type", operationOrURI, status
|  append 
    [|  makeresults
|  eval "Event Type"="SERVICE_METRICS", operationOrURI="getOrderDetails", status="NA"
|  table  "Event Type", operationOrURI, status]
|  append 
    [|  makeresults
|  eval "Event Type"="SERVICE_METRICS", operationOrURI="/getInstallmentPlanHistory", status="F"
|  table  "Event Type", operationOrURI, status]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="status">
          <colorPalette type="map">{"S":#65A637,"F":#D93F3C,"NA":#F7BC38}</colorPalette>
        </format>
        <drilldown>
          <set token="operationOrURI">$row.operationOrURI$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

[niketn]

I would also request you to get the Splunk Dashboard Examples app from splunkbase (https://splunkbase.splunk.com/app/1603/) which has a lot of examples for setting up tokens during drilldown.

[amerineni]

sorry for the delay. My requirement is to not just set a token. Whatever the token that gets passed when we click the operatioURI column, i want the same tokens to be passed to the drilldown when the user clicks on any other column.

Just setting the token is not working. There is no drilldown happening. So i started using the link tag and internally constructed a splunk link with dynamic tokens. That is working fine.

Not sure if there is any better solution. Anyway thanks for your help.

[niketn]

@amerineni, if your intention is to pass on the drilldown token to a new dashboard you would need to use <link> option to pass default drilldown token. Since your original issue was that drilldown token itself was not getting set, we were assisting you with the same.

Seems like it is working now so please accept the answer if this has helped. Do check out Splunk Dashboard Examples app for various options available for drilldown within page to link to a new dashboard. If you are on Splunk Enterprise 6.6 or higher, drilldown option is available within Splunk UI through Edit Panel option. So for most of the basic drilldown scenarios you can directly set the token/link from the UI, which automatically generates the required Simple XML.

[adamblock2]

If the condition statement is removed, I believe you will get the functionality you are looking for.