Dashboards & Visualizations

How to create a dynamic drilldown from chart's legend to populate a new dashboard?

frederick_lefeb
New Member

[I edited this question to reflect further investigation I did]
I created a dashboard that contains a series of timecharts from pivots. I'm trying to create a dynamic drilldown to send user to another dashboard with they click on a specific field.

Following the documentation, I added a marker inside a section on my dashboard like so:

<panel>
      <chart>
        <title>Data transfered by System - Consortia : $consortia$</title>
        <searchString>| pivot globus MyData sum(TB) AS "TB transfered" FILTER CONSORTIUM is $site$ SPLITROW _time AS _time PERIOD day SPLITCOL SYSTEM_NAME SORT 0 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 25 SHOWOTHER 1</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisY2.enabled">false</option>
        ....
        <drilldown target="DrillDown test">
          <link>
             globus_usage_per_system?form.system=$click.value$
           </link>
        </drilldown> 
      </chart>
</panel>

The link works but $click.value$ is not replaced and so, in the resulting URL, I get '$click.value$' instead of the actual value. I later noticed that if I click inside the graph, it seems to work. My issue is I want to click on the chart's legend to populate a new dashboard from the legend entry that was clicked. Is that possible ?

0 Karma

ngatchasandra
Builder

during tests of your process , i received always error due to name of view that concern a alphanumeric caracters, please if you can specify all your code precisely, this will help me exactly. I try to do your process like this, but it return the results drildown in the same dashboard:

<row>
        <chart id="master">
            <title>Master</title>
            <searchString>...........field</searchString>
            <earliestTime></earliestTime>
            <latestTime></latestTime>

            <option name="drilldown">bar</option>
            <drilldown>

                <set token="field">$bar.field$</set>
                <!-- If we also set the form.sourcetype the input will get updated too -->
                <set token="form.field">$bar.field$</set>
            </drilldown>
        </chart>
    </row>
    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <chart id="detail" depends="$field$">
            <title>Detail: $field$</title>
            <searchTemplate>index=.... field=$field$ | timechart count</searchTemplate>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
        </chart>
    </row>
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...