Alerting

Can you help me enable the trellis automatically in a dashboard drill down?

manic3773
Engager

I have a dashboard with a single figure. I have enabled drilldown to open a custom search.
The problem i'm having is enabling the trellis automatically. I've checked various docs but its not helping.

Can I drill down to a custom search and have the trellis view automatically enabled from a dashboard?

here is the code for the XML

<panel>
      <title>Netscaler Hits</title>
      <input type="time" token="field2">
        <label></label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <single>
        <search>
          <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">
          <option name="trellis.enabled">1</option>
          <option name="trellis.size">medium</option>
          <option name="trellis.scales.shared">0</option> 
            search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest</link>
        </drilldown>
      </single>
    </panel>
0 Karma
1 Solution

sdchakraborty
Contributor

Hi,

Can you try the below code,

<panel>
       <title>Netscaler Hits</title>
       <input type="time" token="field2">
         <label></label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
       <single>
         <search>
           <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
           <earliest>$field2.earliest$</earliest>
           <latest>$field2.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="drilldown">all</option>
         <option name="refresh.display">progressbar</option>
         <drilldown>
           <link target="_blank">
             /app/search/search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest&amp;display.page.search.mode=fast&amp;dispatch.sample_ratio=1&amp;display.general.type=visualizations&amp;display.page.search.tab=visualizations&amp;display.visualizations.trellis.enabled=1</link>
         </drilldown>
       </single>
     </panel>

View solution in original post

sdchakraborty
Contributor

Hi,

Can you try the below code,

<panel>
       <title>Netscaler Hits</title>
       <input type="time" token="field2">
         <label></label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
       <single>
         <search>
           <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
           <earliest>$field2.earliest$</earliest>
           <latest>$field2.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="drilldown">all</option>
         <option name="refresh.display">progressbar</option>
         <drilldown>
           <link target="_blank">
             /app/search/search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest&amp;display.page.search.mode=fast&amp;dispatch.sample_ratio=1&amp;display.general.type=visualizations&amp;display.page.search.tab=visualizations&amp;display.visualizations.trellis.enabled=1</link>
         </drilldown>
       </single>
     </panel>
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...