Dashboards & Visualizations

Drilldown on only one row

krusovice
Path Finder

Hello,

I've one requirement which could be done using drilldown but I've no idea on the method to use.

This is the first panel to show to total request as one of the column.

 date_hour      Total Request      Toy Count     Play Count       Failed Count      % Failed
   1                 50               30            10               10                20%
   2                 40               20            10               10                25%

My requirement is to enable the user to only click on the "Total Request" and next panel is to have the list of request ID. For example, click on date_hour=1 and Total Request=50 will display next panel to show 50 Request ID. I tried the search but no luck in finding the solution to only drilldown based on one row selection.

Pls help, thank you.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

p_gurav
Champion

You can use below xml format for drilldown. I put drilldown based on date_hour field, you can use total_request to drilldown.

<dashboard>
  <label>sample123</label>
  <row>
    <panel>
      <title>abc1</title>
      <table>
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie   | stats count by date_hour | sort - date_hour</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="abc">$row.date_hour$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>abc</title>
      <table depends="$abc$">
        <search>
          <query>index="tutorialdata"  sourcetype=access_combined_wcookie  date_hour=$abc$ | stats list(_raw) by _time</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

krusovice
Path Finder

Thank you @p_gurav, it's worked well 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...