Alerting

Can you help me enable the trellis automatically in a dashboard drill down?

manic3773
Engager

I have a dashboard with a single figure. I have enabled drilldown to open a custom search.
The problem i'm having is enabling the trellis automatically. I've checked various docs but its not helping.

Can I drill down to a custom search and have the trellis view automatically enabled from a dashboard?

here is the code for the XML

<panel>
      <title>Netscaler Hits</title>
      <input type="time" token="field2">
        <label></label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <single>
        <search>
          <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">
          <option name="trellis.enabled">1</option>
          <option name="trellis.size">medium</option>
          <option name="trellis.scales.shared">0</option> 
            search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest</link>
        </drilldown>
      </single>
    </panel>
0 Karma
1 Solution

sdchakraborty
Contributor

Hi,

Can you try the below code,

<panel>
       <title>Netscaler Hits</title>
       <input type="time" token="field2">
         <label></label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
       <single>
         <search>
           <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
           <earliest>$field2.earliest$</earliest>
           <latest>$field2.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="drilldown">all</option>
         <option name="refresh.display">progressbar</option>
         <drilldown>
           <link target="_blank">
             /app/search/search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest&amp;display.page.search.mode=fast&amp;dispatch.sample_ratio=1&amp;display.general.type=visualizations&amp;display.page.search.tab=visualizations&amp;display.visualizations.trellis.enabled=1</link>
         </drilldown>
       </single>
     </panel>

View solution in original post

sdchakraborty
Contributor

Hi,

Can you try the below code,

<panel>
       <title>Netscaler Hits</title>
       <input type="time" token="field2">
         <label></label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
       <single>
         <search>
           <query>index=netscaler http_method="POST" OR http_method=GET |  stats count as Total</query>
           <earliest>$field2.earliest$</earliest>
           <latest>$field2.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="drilldown">all</option>
         <option name="refresh.display">progressbar</option>
         <drilldown>
           <link target="_blank">
             /app/search/search?q=index=netscaler http_method="POST" OR http_method=GET | timechart count by host&amp;earliest=$field2.earliest$&amp;latest=$field2.latest&amp;display.page.search.mode=fast&amp;dispatch.sample_ratio=1&amp;display.general.type=visualizations&amp;display.page.search.tab=visualizations&amp;display.visualizations.trellis.enabled=1</link>
         </drilldown>
       </single>
     </panel>
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...