Spread our blog

How To Pass Country Value From a Cluster Map using Drilldown

Hi guys!!

Today we will show you a new and interesting thing which you had not seen before.

We all know that in Drilldown option we can pass values between two or more panels using tokens.  Also it allows to pass values between two different dashboards. In case of Cluster map creating drilldown is little bit tricky.

Today we will show you how to pass Country values from a Cluster Map using drilldown.

Step 1:

We have created a sample dashboard.

Make a dashboard with cluster map visualization, then create  another panel in same dashboard with table format. The query for PANEL1 and PANEL2 are given below.


index=_internal sourcetype="splunkd_ui_access" 
|iplocation clientip
| geostats count by Country


index=_internal sourcetype="splunkd_ui_access"  
| iplocation clientip prefix=client
| table client*


Step 2:

Now you can see  Edit option on the top right side of the dashboard . Click on Edit.

Step 3:

Now you can see Source option on the top left side of the dashboard. Click on Source.

Step 4:

Now edit the source code of dashboard as follows.

<option name=”drilldown”>all</option>

         <set token="map.click.south">$click.bounds.south$</set>

         <set token="map.click.east">$click.bounds.east$</set>

         <set token="map.click.north">$click.bounds.north$</set>

         <set token="map.click.west">$click.bounds.west$</set>

First of all set all in drilldown option . Then add the drilldown tag in your source code. Then carefully see the tokens which have been given above.

click.bounds.south  is the token which tell us the value of south coordinate, where we clicked in the map. In same  click.bounds.east,  click.bounds.north,  click.bounds.west tell us the value of east,north,west respectively.

You can also know about :  How to change width of a dashboard panel?

So, we can easily find the latitude and longitude values.

Then click Save button and Refresh(ctrl+r) the page.

NOTE: In the options <option name=”charting.drilldown”>all</option> is set as all. Otherwise your drilldown will be not working. 

Step 5: 

You have to pass the token inside the query of  second panel to get the data depending upon the token value.

At that time, we will click in Edit button and will go in PANEL2. Then click in Edit search Option and add a line in Query portion. The line is given below.

| search clientlat >= $map.click.south$ clientlat <= $map.click.north$ clientlon >= $map.click.west$ clientlon <= $map.click.east$

Then click on the Apply button and then click in Save button.

Now in the dashboard PANEL2 is depends upon token values of PANEL1. When you click any portion in the cluster map then for that particular Country you will get the output in below panel. For more information about geostats command and iplocation command you can visit Usage of Splunk commands : GEOSTATS and Usage of Splunk commands  : IPLOCATION

Hope this has helped you in achieving the below requirement without fail !!

How To Pass Country Value From a Cluster Map using Drilldown


Happy Splunking !!

What’s your Reaction?

Spread our blog
Previous articleHow To Replace Any String Or Values In A Specific Event In Splunk
Passionate content developer dedicated to producing result-oriented content, a specialist in technical and marketing niche writing!! Splunk Geek is a professional content writer with 6 years of experience and has been working for businesses of all types and sizes. It believes in offering insightful, educational, and valuable content and it's work reflects that.


  1. Hi Team,

    I tried, this is not working. I am trying to pass the table level drilldown on the cluster maps. Could you please suggest?


Please enter your comment!
Please enter your name here