Solved: Single drilldown from multiple charts

MatMeredith · ‎06-28-2013

I have a dashboard which contains three charts all of which present different views of the same data. I'd like to set up my dashboard so that when the user clicks on a data point in one of the three charts, a fourth drilldown chart is rendered at the bottom of the page. I want to perform the same drilldown action irrespective of which of the three charts is clicked on.

I'm using Sideview Utils. Is this possible?

At the moment, I've configured the same drilldown logic in each of my three charts. This means that the code is repeated, and the drilldown chart opens beneath whichever chart the user clicks on. I'd rather avoid the code repetition, and also always have the drilldown chart open at the bottom of the page.

sideview · ‎06-28-2013

You've found one of the core use cases of the Gate module. The Gate module has been released for a while, but quietly, in that it is still undocumented. Sideview has used Gate in some of its apps but that's about it.

Essentially, nested just downstream from each of your three charts, you put this one module:

<module name="Gate">
  <param name="to">myCommonDrilldown</param>
</module>

and then upstream from what will be your shared drilldown table, you put this:

<module name="Gate">
  <param name="id">myCommonDrilldown</param>
  ...

Gate has one other major use case, and although it's not related to your needs here I will mention it as quickly - Gate can prevent a push from proceeding downstream until some key or keys are set. So for example if you have two or more Pulldowns, you don't want to put a Button next to them, and you want the main search on the page to only run when all of the Pulldowns are set, you would use a Gate there. Again, this other feature of Gate has nothing to do with your use case.

If you don't mind using a Sideview module that is not fully documented, go ahead. there is basic param reference documentation that you can see by going to /en-US/modules in SplunkWeb. the next release of Sideview Utils (2.5) will be out in a few days and the Gate module will be final and will also have official docs-and-examples pages in Sideview Utils. If you get the latest (2.4.10), it's in there, but it's still has a prototype status.

Remember this is all only in the latest Sideview Utils, available for free but only available from the Sideview site - http://sideviewapps.com/apps/sideview-utils . Not many companies are still on the old version, but there are still some strange holdouts out there.

View solution in original post

sideview · ‎06-28-2013

You've found one of the core use cases of the Gate module. The Gate module has been released for a while, but quietly, in that it is still undocumented. Sideview has used Gate in some of its apps but that's about it.

Essentially, nested just downstream from each of your three charts, you put this one module:

<module name="Gate">
  <param name="to">myCommonDrilldown</param>
</module>

and then upstream from what will be your shared drilldown table, you put this:

<module name="Gate">
  <param name="id">myCommonDrilldown</param>
  ...

Gate has one other major use case, and although it's not related to your needs here I will mention it as quickly - Gate can prevent a push from proceeding downstream until some key or keys are set. So for example if you have two or more Pulldowns, you don't want to put a Button next to them, and you want the main search on the page to only run when all of the Pulldowns are set, you would use a Gate there. Again, this other feature of Gate has nothing to do with your use case.

If you don't mind using a Sideview module that is not fully documented, go ahead. there is basic param reference documentation that you can see by going to /en-US/modules in SplunkWeb. the next release of Sideview Utils (2.5) will be out in a few days and the Gate module will be final and will also have official docs-and-examples pages in Sideview Utils. If you get the latest (2.4.10), it's in there, but it's still has a prototype status.

Remember this is all only in the latest Sideview Utils, available for free but only available from the Sideview site - http://sideviewapps.com/apps/sideview-utils . Not many companies are still on the old version, but there are still some strange holdouts out there.

sideview · ‎07-05-2013

Sideview Utils 2.5 is now out, the Gate module does now have official documentation, and indeed there were substantial bugfixes in Gate between 2.4.10 and 2.5. So if you downloaded 2.4.10 and have been using the Gate module, I recommend updating to 2.5. Cheers.

anjneesharma · ‎06-29-2018

Even i have same question to ask but i could not understand from above solution i am pasting my problem bellow.

    <panel>
          <title>New CRs</title>
          <html class="html">
                    <div class="help-tip">  
                    <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
                    </div>
                </html>
          <single>
            <search>
              <query>|`macro_ChangeRequest_JIRA`|search "CR State"="*"|table _time "Request item" "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
              <earliest>-48h</earliest>
              <latest>now</latest>
            </search>
            <option name="colorBy">value</option>
            <option name="colorMode">none</option>
            <option name="drilldown">all</option>
            <option name="height">80</option>
            <option name="linkView">search</option>
            <option name="numberPrecision">0</option>
            <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
            <option name="rangeValues">[0]</option>
            <option name="showSparkline">1</option>
            <option name="showTrendIndicator">1</option>
            <option name="trendColorInterpretation">standard</option>
            <option name="trendDisplayMode">absolute</option>
            <option name="underLabel">New CRs</option>
            <option name="unitPosition">before</option>
            <option name="useColors">1</option>
            <option name="useThousandSeparators">1</option>
            <option name="link.visible">0</option>
            <drilldown target="_self">
              <set token="NewCR_tok">$click.value$</set>
              <unset token="Opencr_tok"></unset>
              <unset token="OpenCR_tok"></unset>
              <unset token="OnHoldCR_tok"></unset>
            </drilldown>
          </single>
        </panel>

Drill down

<row>
    <panel depends="$NewCR_tok$">
      <input type="checkbox" token="tokReset1" searchWhenChanged="true">
        <label></label>
        <change>
          <unset token="NewCR_tok"></unset>
          <unset token="form.tokReset1"></unset>
        </change>
        <choice value="hide">Hide Details</choice>
        <delimiter> </delimiter>
      </input>
      <table>
        <title>New CRs details</title>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" reated "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"="*"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
          <earliest>-48h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">0</option>
      </table>
    </panel>
    </raw>

second columen


<panel>
      <title>Open CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the number of Open CRs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Complete" "CR State"!="On Hold"|table _time "Request item" "CR State" "JIRA #" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Open CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown target="_self">
          <set token="OpenCR_tok">$click.value$</set>
          <unset token="Opencr_tok"></unset>
          <unset token="NewCR_tok"></unset>
          <unset token="OnHoldCR_tok"></unset>
        </drilldown>
      </single>
    </panel>


Drill down


<row>
    <panel depends="$OpenCR_tok$">
      <input type="checkbox" token="tokReset2" searchWhenChanged="true">
        <label></label>
        <change>
          <unset token="OpenCR_tok"></unset>
          <unset token="form.tokReset2"></unset>
        </change>
        <choice value="hide">Hide Details</choice>
        <delimiter> </delimiter>
      </input>
      <table>
        <title>Open CRs details</title>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" Created "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"!="Closed Skipped" "CR State"!="Closed Incomplete" "CR State"!="Closed Complete" "CR State"!="On Hold" "CR State"!="Closed Incomplete (Cancelled)""CR State"!="Closed Skipped (Rejected)"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">0</option>
      </table>
    </panel>
  </row>

like this i have 5 single value chart and 5 drill down table how can i combine in single table could you please explain me with example.

Single drilldown from multiple charts

Routing logs with Splunk OTel Collector for Kubernetes

Welcome to the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM