Dashboards & Visualizations

Can you help me with my drilldown issue involving a URL?

Shan
Builder

I have a problem in drilldown. Please help me out.

When i click on the field(Ticket) value, it will open up the drilldown panel. When i click on the value in (index=_internal | table *) query.

As i mention below, a Wikipedia url to web page will be navigated from the drilldown panel of the dashboard(working perfect). But, in the dashboard, the drilldown result is not showing up once i click the value in (index=_internal | table *) query and navigated to external url(wikipedia).

Please let me know why the drilldown result is hiding when i click the value in (index=_internal | table *) and is moving to external url(wikipedia).

I have provided sample drilldown below.

<drilldown>
          <condition field="Months">
            <set token="Month_depend">true</set>
            <set token="Months">$row.Months$</set>
            <set token="Notsolved">$row.Ticket$</set>
            <set token="Breached">$row.overdue$</set>
            <unset token="seconds"></unset>
            <unset token="Low"></unset>      
            </condition>
          <condition field="Ticket">
            <set token="Ticket">$row.Ticket$</set>
            <set token="seconds">true</set>
            <set token="Months">$row.Months$</set>
            <unset token="Month_depend"></unset>
            <unset token="Low"></unset>
            </condition>      
        </drilldown>     
  <row>
    <panel>
      <title>$Months$</title>
      <table depends="$seconds$">
        <title> </title>
        <search>
          <query>index=_internal | table * </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">
            <![CDATA[https://en.wikipedia.org/wiki/Data]]>
          </link>
          <unset token="seconds"></unset>
        </drilldown>
      </table>
    </panel>
  </row>

Thanks ..

0 Karma
1 Solution

renjith_nair
Legend

@shankarananth,

That's because your drilldown panel is depending on the token seconds as defined in <table depends="$seconds$"> and then you are resetting the token in the drilldown using <unset token="seconds"></unset> .

So, if you do not want your detailed panel (index=_internal | table *) to be hidden when clicking on the link drilldown, just remove the unset option. However, that will keep the panel visible all the time once the seconds token is set.

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@shankarananth,

That's because your drilldown panel is depending on the token seconds as defined in <table depends="$seconds$"> and then you are resetting the token in the drilldown using <unset token="seconds"></unset> .

So, if you do not want your detailed panel (index=_internal | table *) to be hidden when clicking on the link drilldown, just remove the unset option. However, that will keep the panel visible all the time once the seconds token is set.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Shan
Builder

@ renjith.nair,

Thanks for the reply :-)..
Let me try from my end and update you ..

Thanks ..

0 Karma

Shan
Builder

@ renjith.nair,

Thank you .. It's working..

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...