Splunk Search
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

For multiple single value chart use one drilldown table when all chart having drilldown

anjneesharma
New Member
‎06-29-2018 10:50 AM

In my dashboard i have 5 single value chart and all 5 having drilldown so i have 5 drilldown table i want to combine all 5 table into one table because at a time only one token will be having value other will not be having any value.
Could you please help me on this, Thanks in advance

Tags (1)
0 Karma
Reply

niketn
Legend
‎07-02-2018 12:21 PM

@anjneesharma, Your dashboard is Option 2 of my answer above. Only the table corresponding to specific Single Value drilldown is displayed using depends. However, it is missing the token dependency within corresponding table search, which implies all your 5 searches in the table will always run whether table is displayed or not.
There could be several option to add token dependency to your searches without impacting their performance or functioning and at the same time force them to run only when the token is set. For example using comment() macro. Ensure the same is created and accessible for all roles/apps.

| `comment("This adds $NewCR_tok$ token dependency using comment so that search does not run when token is unset.")`

Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Addcommentstosearches#Using_the_comment_m...

Option 1 as explained earlier was to set the complete query as a token in the drilldown instead of setting a token for flag for example instead of setting token NewCR_tok you would set tokQuery as following:

<set token="tokQuery">
|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" reated "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"="*"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region
</set>

Similarly for other Single Value panels as well you will set the same token tokQuery with required search and then have only one <table> with <search><query> as $tokQuery$.

There should be answers on Splunk Answers illustrating both option. Let us know if either one of the approach is not clear or does not work for you!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply

anjneesharma
New Member
‎07-03-2018 12:25 PM

Hi @niketnilay

Option 1 setting whole query in token but token name is same for all 5 Single chart i am trying it but i have one concert i tried same case it din work for me i.e if i will click first on NewCr then it will display NewCr if second time i will click on OpenCr then it will not update Token it will keep on displaying first one only.

bellow is example which i tried using CR_Tok but it always displaying same result 

<panel>
  <title>New CRs</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"="*"|table _time "Request item" "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>-48h</earliest>
      <latest>now</latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">New CRs</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">
      <unset token="CR_tok"></unset>
     <set token="CR_tok">$click.value$</set>
    </drilldown>
  </single>
</panel>
<panel>
  <title>Open CRs</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the number of Open CRs and Drilldown table with information of the CRs.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Complete" "CR State"!="On Hold"|table _time "Request item" "CR State" "JIRA #" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">Open CRs</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">

      <set token="CR_tok">$click.value$</set>
    </drilldown>
  </single>
</panel>
<panel>
  <title>Open Unassigned CRs</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Complete"|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">Open Unassigned CRs</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">

      <set token="CR_tok">$click.value$</set>
    </drilldown>
  </single>
</panel>
<panel>
  <title>On Hold CRs</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the number of open On Hold CRs and Drilldown table with information of the CRs.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"="On Hold"|table _time  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">On Hold CRs</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">

      <set token="CR_tok">$click.value$</set>
    </drilldown>
  </single>
</panel>
<panel>
  <title>Pending for CAB Approval</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the CR'S which are in Pending status for CAB Approval.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"="Internal CAB - Estimates for Review/Approval"|table  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>0</earliest>
      <latest></latest>
      <refresh>48h</refresh>
      <refreshType>delay</refreshType>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">Pending For CAB Approval</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">

      <set token="CR_tok">$click.value$</set>
    </drilldown>
  </single>
</panel>


<panel depends="$CR_tok$">
  <input type="checkbox" token="tokReset1" searchWhenChanged="true">
    <label></label>
    <change>
      <unset token="CR_tok"></unset>
      <unset token="form.tokReset1"></unset>
    </change>
    <choice value="hide">Hide Details</choice>
    <delimiter> </delimiter>
  </input>
  <table>
    <title>CRs details</title>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" reated "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"="*"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
      <earliest>-48h</earliest>
      <latest>now</latest>
    </search>
    <option name="drilldown">none</option>
    <option name="link.visible">1</option>
  </table>
</panel>
0 Karma
Reply

niketn
Legend
‎06-29-2018 10:21 PM

@anjneesharma following are the two options you have:

Option 1) Set the complete SPL Query on each drilldown and use the SPL in the single Drilldown table
Option 2) Set the token from drilldown and pass on from single value to respective table.
2) a) Based on the token set depends attribute for respective tables. So that only clicked Single Value is displayed. Unset the other tokens to keep other tables hidden.
2) b) Ensure that the token dependency is also added to corresponding search(which I believe is already there). This will ensure that the SPL for only the table displayed runs and other hidden table searches keep on waiting for input.

We would be able to assist you further if you provide more details based on the Simple XML code that you currently have. You can take out/mask/anonymize any sensitive information. You should be able to find examples of both approach on Splunk Answers and also in Splunk Dashboard Examples App.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply

anjneesharma
New Member
‎07-02-2018 09:50 AM

Hi @niketnilay

bellow is my xml so bottom i am using 5 table instead of 5 i want to use only one table can you plz elaborate your answer. 

<panel>
  <title>New CRs</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"="*"|table _time "Request item" "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>-48h</earliest>
      <latest>now</latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">New CRs</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">
      <set token="NewCR_tok">$click.value$</set>
      <unset token="Opencr_tok"></unset>
      <unset token="OpenCR_tok"></unset>
      <unset token="OnHoldCR_tok"></unset>
    </drilldown>
  </single>
</panel>
<panel>
  <title>Open CRs</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the number of Open CRs and Drilldown table with information of the CRs.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Complete" "CR State"!="On Hold"|table _time "Request item" "CR State" "JIRA #" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">Open CRs</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">
      <set token="OpenCR_tok">$click.value$</set>
      <unset token="Opencr_tok"></unset>
      <unset token="NewCR_tok"></unset>
      <unset token="OnHoldCR_tok"></unset>
    </drilldown>
  </single>
</panel>
<panel>
  <title>Open Unassigned CRs</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Complete"|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">Open Unassigned CRs</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">
      <set token="Opencr_tok">$click.value$</set>
      <unset token="NewCR_tok"></unset>
      <unset token="OpenCR_tok"></unset>
      <unset token="OnHoldCR_tok"></unset>
    </drilldown>
  </single>
</panel>
<panel>
  <title>On Hold CRs</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the number of open On Hold CRs and Drilldown table with information of the CRs.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"="On Hold"|table _time  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">On Hold CRs</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">
      <set token="OnHoldCR_tok">$click.value$</set>
      <unset token="Opencr_tok"></unset>
      <unset token="NewCR_tok"></unset>
      <unset token="OpenCR_tok"></unset>
    </drilldown>
  </single>
</panel>
<panel>
  <title>Pending for CAB Approval</title>
  <html class="html">
            <div class="help-tip">  
            <p>This view provides the CR'S which are in Pending status for CAB Approval.</p>
            </div>
        </html>
  <single>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|search "CR State"="Internal CAB - Estimates for Review/Approval"|table  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
      <earliest>0</earliest>
      <latest></latest>
      <refresh>48h</refresh>
      <refreshType>delay</refreshType>
    </search>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="height">80</option>
    <option name="linkView">search</option>
    <option name="numberPrecision">0</option>
    <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
    <option name="rangeValues">[0]</option>
    <option name="showSparkline">1</option>
    <option name="showTrendIndicator">1</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="underLabel">Pending For CAB Approval</option>
    <option name="unitPosition">before</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">1</option>
    <option name="link.visible">0</option>
    <drilldown target="_self">
      <set token="CABPending_tok">$click.value$</set>
      <unset token="Opencr_tok"></unset>
      <unset token="OpenCR_tok"></unset>
      <unset token="OnHoldCR_tok"></unset>
    </drilldown>
  </single>
</panel>


<panel depends="$NewCR_tok$">
  <input type="checkbox" token="tokReset1" searchWhenChanged="true">
    <label></label>
    <change>
      <unset token="NewCR_tok"></unset>
      <unset token="form.tokReset1"></unset>
    </change>
    <choice value="hide">Hide Details</choice>
    <delimiter> </delimiter>
  </input>
  <table>
    <title>New CRs details</title>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" reated "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"="*"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
      <earliest>-48h</earliest>
      <latest>now</latest>
    </search>
    <option name="drilldown">none</option>
    <option name="link.visible">0</option>
  </table>
</panel>


<panel depends="$OpenCR_tok$">
  <input type="checkbox" token="tokReset2" searchWhenChanged="true">
    <label></label>
    <change>
      <unset token="OpenCR_tok"></unset>
      <unset token="form.tokReset2"></unset>
    </change>
    <choice value="hide">Hide Details</choice>
    <delimiter> </delimiter>
  </input>
  <table>
    <title>Open CRs details</title>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" Created "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"!="Closed Skipped" "CR State"!="Closed Incomplete" "CR State"!="Closed Complete" "CR State"!="On Hold" "CR State"!="Closed Incomplete (Cancelled)""CR State"!="Closed Skipped (Rejected)"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="drilldown">none</option>
    <option name="link.visible">0</option>
  </table>
</panel>


<panel depends="$Opencr_tok$">
  <input type="checkbox" token="tokReset" searchWhenChanged="true">
    <label></label>
    <change>
      <unset token="Opencr_tok"></unset>
      <unset token="form.tokReset"></unset>
    </change>
    <choice value="hide">Hide Details</choice>
    <delimiter> </delimiter>
  </input>
  <table>
    <title>Open Unassigned CRs details</title>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "JIRA #" "Request item" Created "Created By"|search  "CR State"!="Closed Skipped" "CR State"!="Closed Incomplete" "CR State"!="Closed Complete" "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Skipped (Rejected)"|rename "Request item" as RequestItem|table RequestItem "CR State" "Created By"</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="drilldown">none</option>
    <option name="link.visible">0</option>
  </table>
</panel>


<panel depends="$OnHoldCR_tok$">
  <input type="checkbox" token="tokReset3" searchWhenChanged="true">
    <label></label>
    <change>
      <unset token="OnHoldCR_tok"></unset>
      <unset token="form.tokReset3"></unset>
    </change>
    <choice value="hide">Hide Details</choice>
    <delimiter> </delimiter>
  </input>
  <table>
    <title>On Hold CRs details</title>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" Created "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"="On Hold"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="drilldown">none</option>
    <option name="link.visible">0</option>
  </table>
</panel>


<panel depends="$CABPending_tok$">
  <input type="checkbox" token="tokReset4" searchWhenChanged="true">
    <label></label>
    <change>
      <unset token="CABPending_tok"></unset>
      <unset token="form.tokReset4"></unset>
    </change>
    <choice value="hide">Hide Details</choice>
    <delimiter> </delimiter>
  </input>
  <table>
    <title>CAB Approval Pending CRs details</title>
    <search>
      <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" Created "Created By" "Requestor Country" Application "PO/PM" CAB_Approval|search CAB_Approval="Pending"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="drilldown">none</option>
    <option name="link.visible">0</option>
  </table>
</panel>
0 Karma
Reply

David
Splunk Employee
Splunk Employee
‎06-29-2018 02:30 PM

Can you provide some more details? Perhaps a copy-paste of your XML, and your desired state?

Reply
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...