drill down for cell

[surekhasplunk]

Currenlty i have drill down active for 2 of my columns/cell from table of panels which is working fine taking row.fieldname as an argument which i am mapping to another lookup file to get the drilldown give the required results.

Now i have a total filed as well for those cells. So when i drilldown from the total cell value it gives me error since the mapping doesn't work when i have more than 1 value coming for a particular variable field.

Is there anyways i can disable drilldown for that particular filed or change my query only for that particular field where the corresponding row value is total

[niketn]

Following are your some of your options:
1) Enable the Total rows in Table Summary (Splunk 6.6. onward) :
Using Edit Panel option in Splunk UI through Format Visualization > Summary > Total = Yes or following Simple XML change:

<option name="totalsRow">true</option>

*2) Use eval to set token on Drilldown: *
Use eval with case to set the token only when clicked value is not Department either through $click.value$ (since Department is your left most column), or through $row.Department$. When clicked value is Total, token will be null, you can also add a condition to set it to some default value from your lookup since drilldown will still occur.

*3) Use Simple XML JS Extension with Splunk JS Stack to prevent setting of drilldown token if clicked row's department value is Total: *
I have not created an example of this. Please let me know if above two options do not cater to your needs.

Please try the following run anywhere search.

<dashboard>
  <label>Prevent Drilldown On Total row</label>
  <row>
    <panel>
      <title>Table 1</title>
      <table>
        <title>Drilldown Component: $tokTableComponent1$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=* component=*
| chart count over component by log_level
|  head 5</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">true</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="tokTableComponent1">$click.value$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Table 2</title>
      <table>
        <title>Drilldown Component: $tokTableComponent2$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=* component=*
| chart count over component by log_level
| head 5
| addcoltotals label=Total labelfield=component</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <eval token="tokTableComponent2">case($click.value$!="Total",$click.value$)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

[surekhasplunk]

 Warning on Invalid child="eval" is not allowed in node="conditional-drilldown"

Am already using conditional drill down for that particular field so when am trying to add eval its giving me warning

[niketn]

@surekhasplunk, Can you post code from your drilldown, can the condition block be pushed to eval case?
Also is Option 1 feasible for you? What version of Splunk are you running?

[surekhasplunk]

Hi,

Am using 6.6.3 and option1 will not work since i have two kind of totals first few rows gives me one total and at the end one more total and with this option i cant add label of my wish

[niketn]

Can you share the drilldown code then?

[surekhasplunk]

Hi @niketnilay,

Suppose i choose option1 since this doesn't give me drilldown option.
true

How can i add a custom label to it like "Total" or something. As now it just gives me total of all numeric fileds .IF i want to add label Total to the first field say how do i do it.

[niketn]

@surekhasplunk, if you choose option 1 it will give you drilldown option but prevent drilldown on Total row. Yes with the summary field implementation Total label will not be present.

You can add text through Javascript Extension using TableView from Splunk JS Stack.

Following is run anywhere dashboard which includes script table_summary_row_label.js

Note that table id is table1 and table Simple XML configuration totalsRow is set to true:

 <dashboard  script="table_summary_row_label.js">
   <label>Prevent Drilldown On Total row</label>
   <row>
     <panel>
       <title>Table 1</title>
       <table id="table1">
         <title>Drilldown Component: $tokTableComponent1$</title>
         <search>
           <query>index=_internal sourcetype=splunkd log_level=* component=*
 | chart count over component by log_level
 |  head 5</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="count">20</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">true</option>
         <option name="wrap">true</option>
         <drilldown>
           <set token="tokTableComponent1">$click.value$</set>
         </drilldown>
       </table>
     </panel>
   </row>

Following is the JavaScript Code for table_summary_row_label.js

require([
    'underscore',
    'jquery',
    'splunkjs/mvc',
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {
    mvc.Components.get("table1").getVisualization(function(tableView) {
        tableView.on('rendered', function() {
            $("#table1 .shared-resultstable-resultstablesummaryrow .null").html("Total");
        });
    });
});

Since it involves static JavaScript file, you may need to restart/refresh/bump Splunk and also clear internet browser history for changes to reflect. Please try out and confirm.

[surekhasplunk]

Hi @niketnilay,

below is my drilldown code for reference to show what am doing now.

        <drilldown target="_blank">
          <condition field="Perm">
            <link>/app/myapp/drilldown_perm?ba=$row.Business Area$</link>
           </condition>
          <condition field="Cont">
            <link>/app/myapp/drilldown_cont?ba=$row.Business Area$</link>
          </condition>
          </drilldown>

Now the ba variable has the business area name which i am using as input variable for drilldown dashboard.
So here i want to just restrict the drilldown when i see value Total in row.Business Area

[niketn]

@surekhasplunk, I am not sure if I understand what you mean by mapping doesn't work when i have more than 1 value coming for a particular variable field. What are the multiple values and how are multiple values being set?

Based on the description seems like you need to code condition block with field names using field="Total", field="field1", field="field1" etc.

http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_tokens_for_conditional_operatio...

For example:

    <drilldown>
      <condition field="Total">
        <set token="tokTotal">$row.fieldName$</set>
        ...
      </condition>
    </drilldown>

[surekhasplunk]

example i have results something like below.

Department     Permanent       Contract     Both
computers       6                   4             10
civil                    9                  1              10
mechanical      8                  5               13
Total                23                 10              33

Now i am taking deparment names in row.department variable and then passing it for lookup to another file and getting results depending on the department name in the drilldown feature.
But when someone clicks on total value 23 or 10 then its failing coz its not able to search the department name in the drilldown lookup file.

How to deal with this scenario