i have many single value panels in a dashboard,So When i click a panel it should open with same search string in a new tab. i tried with custom drill down ,but its opening a empty new tab. kindly guide me
@SapthagiriAavikov, following is a run anywhere dashboard based on Splunk's _internal
index to show the options to run the search in a new window for Single Value Trellis Layout as well as Single Value without Trellis.
<form>
<label>Trellis single value drilldown</label>
<fieldset submitButton="false">
<input type="time" token="field1" searchWhenChanged="true">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<search>
<query>index=_internal sourcetype=splunkd log_level!=INFO earliest=-24h@h latest=now
| stats count by component</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">1</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trellis.splitBy">component</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<drilldown>
<link target="_blank">search?q=index="_internal" sourcetype="splunkd" log_level!="INFO" component="$trellis.value$"
| stats count by component&earliest=$field1.earliest$&latest=$field1.latest$</link>
</drilldown>
</single>
</panel>
</row>
<row>
<panel>
<single>
<title>$tokClickName$</title>
<search>
<query>index=_internal sourcetype=splunkd log_level!=INFO earliest=-24h@h latest=now
| stats count by component
| sort - count
| head 1
| table count component</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<drilldown>
<condition match="$row.component$="TimeoutHeap"">
<set token="tokClickName">$row.component$</set>
<link target="_blank">search?q=index=_internal sourcetype=splunkd log_level!=INFO
| stats count by component
| sort - count
| search count="$click.value$" AND component="$row.component$"&earliest=$field1.earliest$&latest=$field1.latest$</link>
</condition>
<condition>
<!-- DO NOTHING-->
<set token="tokClickName">$row.component$</set>
</condition>
</drilldown>
</single>
</panel>
</row>
</form>
Please try out and confirm!
@SapthagiriAavikov, are you using Trellis
for multiple Single Value panels or does each Single Value panel have its own query?
Hey follow this example and edit the source of the dashboard:
<dashboard>
<label>Test1</label>
<row>
<panel>
<single>
<search>
<query>index=_internal | head 10 | where source like "%" | stats count</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">all</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>