Spread our blog

How To Disable Drilldown Option For Certain Value(s) In Splunk

Hello everyone !!

Today we have a come with a latest topic of Splunk. All we know that for making an attractive dashboard we need drilldown. Are you feeling boring with normal drilldown in Splunk ??
We will show you how to disable drilldown option for certain value(s) in Splunk.

See below we have created a dashboard called Restricted Drilldown.

 Here we have two panels. Query behind the first panel is :

index=_internal sourcetype=splunkd_ui_access
| stats count by method
| addcoltotals label="Total" labelfield="method"

Query behind the second panel is :

index=_internal sourcetype=splunkd_ui_access
| stats count by method,status

We want to open the below chart using drilldown. We will click some value in the method field of the first panel and our below panel will be opened. But one condition is there when we click on Total , drilldown panel should not open as Total is not a value of method field. It has come for using addcoltotals command. So how to do that thing ???

Step 1:
You can see Edit button on the top right side of the dashboard. Click on Edit.

Step 2 :
You can see Source option on the top left side of the dashboard. Click on Source.

Step 3 :
Modify Source code.



At first you have to enable the drilldown option in the table. For enabling drilldown option we have written

<option name="drilldown">row</option>

Then we have to set token in the drilldown tag. For set and unset  token we have used two  condition tag. For first condition tag we have used match attribute. If the row.method not equal to Total then set the method_token.

<condition match="NOT match('row.method', &quot;Total&quot;)">
<set token="method_token">$row.method

lt;/set> <condition>


Again we have used another condition tag with match attribute.If the row.method  equal to Total then unset the method_token.

<condition match="match('row.method', &quot;Total&quot;)">
<unset token="method_token">$row.method</unset>
</condition>

Then we have made the second row dependent upon method_token using depends attribute.

<row depends="$method_token$">

Also pass the token inside title tag of the second panel.

<title>Drilldown Panel Opened For $method_token$ </title>

We have passed the token inside the query of the second panel.

<query>index=_internal sourcetype=splunkd_ui_access method="$method_token$" | stats count by method,status</query>

At last click on Save to save the changes.

Step 4:
See the drilldown panel will open only when we click any value in the method field except Total.
We have clicked GET in method field so in the below panel we are getting data for GET.


We have clicked Total in method field so drilldown option will not work.

Also you can download the source code of this sample dashboard by clicking the below button. 

SourceCode

You can also know about :  Restrict Splunk drill-down for a Specific Field

Hope this has helped you in achieving the below requirement without fail:

How To Disable Drilldown Option For Certain Value(s) In Splunk

Happy Splunking !!

What’s your Reaction?
+1
+1
+1
+1
+1
+1
+1

Spread our blog
Previous articleHow To find The Current Size And Total Event Count Of Any Index In Splunk
Next articleLINE_BREAKER
Passionate content developer dedicated to producing result-oriented content, a specialist in technical and marketing niche writing!! Splunk Geek is a professional content writer with 6 years of experience and has been working for businesses of all types and sizes. It believes in offering insightful, educational, and valuable content and it's work reflects that.

1 COMMENT

LEAVE A REPLY

Please enter your comment!
Please enter your name here