Splunk Search

Question on multiple condition value for Cell drilldown

prettysunshinez
Explorer

Hi,

I have a panel in dashboard in table format.
Example Table format as below :

Signs Count
Sigma 20
Board 30
Sierra 40
Odd 89

Now when I click Sigma,I wanted to have the search result for the query ------ index= 'Sigma'
And when I click Board,search result of index= 'Board'...Similarly for Sierra too.
But when I click Odd, I wanted to run a different query altogether and get the search result of it.

Please help me achieve it.

Thanks in advance!

Tags (1)
0 Karma

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>drilldown Clone</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval Signs="Sigma",Count=20 
| append 
    [| makeresults | eval Signs="Board",Count=30] 
| append 
    [| makeresults | eval Signs="Sierra",Count=40] 
| append 
    [| makeresults | eval Signs="Odd",Count=89]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="'row.Signs' == &quot;Odd&quot;">
            <set token="query">index=_internal|table date_hour,date_mday,date_second</set>
          </condition>
          <condition>
            <set token="query">index=$row.Signs$</set>
          </condition>
          <condition></condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$query$">
    <panel>
      <table>
        <search>
          <query>$query$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...