Dashboards & Visualizations

Drilldown on only one row

krusovice
Path Finder

Hello,

I've one requirement which could be done using drilldown but I've no idea on the method to use.

This is the first panel to show to total request as one of the column.

 date_hour      Total Request      Toy Count     Play Count       Failed Count      % Failed
   1                 50               30            10               10                20%
   2                 40               20            10               10                25%

My requirement is to enable the user to only click on the "Total Request" and next panel is to have the list of request ID. For example, click on date_hour=1 and Total Request=50 will display next panel to show 50 Request ID. I tried the search but no luck in finding the solution to only drilldown based on one row selection.

Pls help, thank you.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

krusovice
Path Finder

Thank you @p_gurav, it's worked well 🙂

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...