Dashboards & Visualizations

Drilldown not working properly.

NicoloPunzalan2
Engager

Hi All,

I have a panel containing the top 10 resolution profiles of our tickets and I want to have a drilldown table which when I click the value of the Resolution Profile, there will be a table below which contains the ticket details like ticket number and assignment group.

My drilldown works fine with the top 1 resolution profile, but when I select other resolution profiles, It gets some other ticket details which is not the one that I clicked in the table. Can you help me please with my query? Please see below query that I have.

<search>
          <query>.......| stats count by u_resolution_profiles</query>
 </search>

<drilldown>
    <set token="Value_tkn">$click.value$</set>
</drilldown>

<table depends="$Value_tkn$">
 <search>
          <query>.......|search $Value_tkn$| table ticket_number u_resolution_profiles assignment_group assigned_to| rename ticket_number as "Ticket Number" u_resolution_profiles as "Resolution Profile" assignment_group as "Assignment Group" assigned_to as "Assigned To"</query>

Thanks in advance,
Nicolo

0 Karma
1 Solution

mayurr98
Super Champion

try specifying field names in search
| search u_resolution_profiles="$Value_tkn$"

Also when you click on the panel open the drill down in the new search and look what is getting substituted. I am sure you will get an answer if you open the drilldown panel in search.

View solution in original post

mayurr98
Super Champion

try specifying field names in search
| search u_resolution_profiles="$Value_tkn$"

Also when you click on the panel open the drill down in the new search and look what is getting substituted. I am sure you will get an answer if you open the drilldown panel in search.

NicoloPunzalan2
Engager

Hi @mayurr98,

Have tried the changes and worked properly. Thanks a lot!
Hope you have a good day ahead.

All the best,
Nicolo

0 Karma

niketn
Legend

@NicoloPunzalan24, I have converted to Answers. Please Accept to mark this as answered. Also up vote the comment/s that helped 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Yunagi
Communicator

Have a look at Define tokens for dynamic drilldown

I suggest the following changes:

<drilldown>
  <condition field="u_resolution_profiles">
    <set token="Value_tkn">$click.value2$</set>
  </condition>
</drilldown>

Also, change your other search to:

<query>....... | search u_resolution_profiles="$Value_tkn$" | .......
0 Karma

mayurr98
Super Champion

hey @NicoloPunzalan24
in your search query put

| search "$Value_tkn$"

"" in query and try again

let me know if it helps!

0 Karma

NicoloPunzalan2
Engager

Hi @mayurr98,

I tried to add them but it still doesn't work. 😞

Thanks,
Nicolo

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...