Splunk Search

Why is the condition tag in my drilldown not working as expected and how do I fix this behavior?

adityapavan18
Contributor

Hi All
I have a dashboard as following:
Panel 2 is a table I am enabling drilldown on column "general_exception_type" using a condition tag.
I am expecting the drilldown to happen when a value in general_exception_type column is clicked, and nothing should happen when I click any value in count column.

After adding the condition tag, the drilldown is working on the general_exception_type column value when clicked, but when i click on a value in the count column (i expected nothing to happen), it's opening a search window. How do I disable that behavior?

I only need the drilldown to work when clicking on any value in column1 and nothing when clicked on any other value in column.

<dashboard>
      <label>Error Token Dashboard</label>
      <description/>
      <row>
        <panel>
          <single>
            <title>Tokens Found</title>
            <option name="classField">range</option>
            <searchString>index=sample | stats count by general_exception_type | stats count</searchString>
            <earliestTime>@d</earliestTime>
            <latestTime>now</latestTime>
            <option name="drilldown">all</option>
            <option name="beforeLabel">Number Of Error Tokens found in the logs today</option>
            <drilldown>
                <set token="tk">$click.value$</set>
            </drilldown>
          </single>
        </panel>
        <panel>
          <table depends="$tk$">
            <title>Tokens List</title>
            <searchString>index=sample | stats count by general_exception_type</searchString>
            <earliestTime>@d</earliestTime>
            <latestTime>now</latestTime>
            <option name="drilldown">row</option>
            <drilldown>
              <condition field="general_exception_type">
                <set token="exception">$row.general_exception_type$</set>
              </condition>
            </drilldown>
          </table>
        </panel>
      </row>
      <row>
        <panel>
        <event depends="$exception$">
           <title>Token Events</title>
            <searchString>index=sample general_exception_type=$exception$</searchString>
          <earliestTime>@d</earliestTime>
            <latestTime>now</latestTime>
           <option name="drilldown">none</option>
        </event>
        </panel>
      </row>
    </dashboard>
0 Karma
1 Solution

ramdaspr
Contributor

The below code will force the other fields to disable drilldown

<drilldown>
<condition field="general_exception_type">
<set token="exception">$row.general_exception_type$</set>
</condition>
<condition field="*">
</condition>
</drilldown>

View solution in original post

ramdaspr
Contributor

The below code will force the other fields to disable drilldown

<drilldown>
<condition field="general_exception_type">
<set token="exception">$row.general_exception_type$</set>
</condition>
<condition field="*">
</condition>
</drilldown>

adityapavan18
Contributor

Thank you.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...