Dashboards & Visualizations

i have a panel with two different error codes and i want to do drill down. if i click on the error code 1 it should run a query if i click error code 2 it should run a different query.

DataOrg
Builder

the query should be dynamic based on the click of error codes. i want the drilldown panel to be displayed i same page

0 Karma

cmerriman
Super Champion

you'll want to use the <drilldown> node in the base panel. something like this:

<drilldown>
    <set token="tokenName">$click.value$</set>
</drilldown>

you can add a depends="$tokenName$" to the panel node to hide/show the drilled into panel.
documentation on drilldowns.
http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/ContextualDrilldown

if you can give more detail on what is being drilled down (see @jeffland 's comment) and any start to your simple XML, that would be very helpful.

0 Karma

DataOrg
Builder

errorcode1 fetch results from different database and errorcode 2 fetch results from another database. so i want to have two quireis

0 Karma

cmerriman
Super Champion

you're XML will look something like this (it'll take a little tweaking, especially the conditional drilldowns, depending on your data). here is a link on how that works: http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/tokens#Define_conditional_matching

  <row>
    <panel>
      <table>
        <search>
          <query>query for error codes</query>
          <earliest>earliest time</earliest>
          <latest>latest time</latest>
        </search>
        <drilldown>
            <condition match="$click.value$=error1">
                <set token="error1">$click.value$</set>
            </condition>
            <condition match="$click.value$=error2">
                <set token="error2">$click.value$</set>
            </condition>
        </drilldown>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Error 1</title>
      <table depends="$error1$">
        <title>Error1</title>
        <search>
          <query>new query for error1</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">20</option>
      </table>
    </panel>
   <row>
   <row>
    <panel>
      <title>Error 2</title>
      <table depends="$error2$">
        <search>
          <query>new query for error2</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">20</option>
      </table>
    </panel>
   <row>
0 Karma

jeffland
SplunkTrust
SplunkTrust

Where do the different queries come from? Is there a lookup somewhere which defines a search per error code, or do you want to hardcode this into the dashboard? Or is the query mostly the same and only uses the error code somewhere, such as search index=foo code="$errorCode$"?

0 Karma

DataOrg
Builder

hi Jeffland,
both are different queries not similar one matched on errorcode.i want to hardcore in the dashboard.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...