Use drilldown for dashboard interactivity

You might want to share additional data insights when users click on data points, table rows, or other visualization elements in a dashboard. Use drilldown to build this interactivity into your dashboards.

How drilldown works

Drilldown is a tool for configuring responses to user clicks on visualizations in a dashboard or form. Drilldown behavior is configured within individual visualizations. You can have separate drilldown configurations for each visualization in a dashboard. Depending on the visualization type, you can also enable drilldown on specific elements in a visualization, such as a table row or cell.

Drilldown actions

The drilldown actions that you configure happen when a user clicks the visualization element where the drilldown is enabled.

Link to a target
Drilldown can link a source dashboard or form to an external target that opens on a user click. The target can be a secondary search, another dashboard or form, or a website.

If you link to a website, make sure that you use a validly encoded URL. For example, any question marks (?) that should be recognized as question marks in a URL link should be changed to %3F. You can also create tokens for encoded URL characters that can be used in multiple places in your XML.

Trigger interactive behavior in the current dashboard
Drilldown can also trigger contextual changes in the same dashboard or form. For example, you can show or hide content depending on a clicked value.

Using tokens to customize a drilldown

Tokens are like programming variables. A token name represents a value that can change, such as a user selection in a form input. You can use a token name to access the value that it represents. In drilldown, you can use tokens to capture contextual values from the current dashboard or values from clicked elements. You might also define custom tokens to help implement interactive behavior.

You can pass token values to a target search, dashboard, or URL by configuring a drilldown to set tokens in the target to the captured source values. Setting token values in this way lets you show customized content in the target.

You can also use token values to trigger interactive changes in the current dashboard, such as content display or more specific search results. Configure elements in the current dashboard to listen for and respond to these changes.

Tokens available in drilldown

Several predefined token types representing dashboard events are available within a drilldown context. You can use these tokens to access clicked fields, search events, and other dynamic values.

See Token usage in dashboards for details on working with the following token types.

Form input change events

Form inputs use a token to represent the value that users select in the input. If your drilldown target is a form, you can pass a value from a source dashboard to the input token in the target form so that users see content customized for the selected value.

To determine the token name for a form input, check the Simple XML source code for that input.

Search events

Predefined tokens represent search progress and completion events. Include search event handlers inside the <search> element for a visualization to get search job or result properties. You can use tokens to pass these values to the <drilldown> element.

Tokens set on page load

You can use an <init> element to set token values when a dashboard loads in the browser. You can access token values from the <init> element in a <drilldown>.

Chart navigation and selection events

You can access token values representing user pan and zoom or selection events in some chart types. See Chart controls for more information on working with these tokens.

Predefined click event tokens

Some tokens that you can use for drilldown are predefined in Splunk software. You can use these tokens to capture user actions or other values from a dashboard. For example, you can use the predefined $click.value2$ token to capture a clicked table cell value.

See Predefined drilldown tokens in the Simple XML Reference for a list of predefined tokens available for each visualization.

Custom tokens

In addition to predefined tokens, you can create custom tokens to help create dynamic or conditional display behavior. These tokens can represent other values that change, such as search results.

Choose a drilldown action

Choose a drilldown action depending on the type of interactive behavior that you want and the data insights that you are sharing with users.

To view the most common use cases and examples of how to use a drilldown actions, note that you can access the Splunk Dashboards Quick Reference guide by clicking the link in Getting started.

Action	Type	Behavior and configuration
Link to a search	Link to a target	Open a search page in the browser. A secondary search generates automatically to show results for the clicked value. You can also create a custom search.
Link to a different dashboard or form	Link to a target	Open a target dashboard or form in the browser. Use tokens to pass values to the target and show content customized to the clicked value or other values from the source.
Link to a URL	Link to a target	Open an external website in the browser. Pass token values from the source to the URL as query string parameters.
Manage token values in the current dashboard or form	Trigger interactivity in the current dashboard	Set, unset, or filter token values when a user clicks on an element in a dashboard or form. Instead of linking to a different location, use token value changes to configure interactive behavior in the same dashboard. For example, you can use depends or rejects attributes in the dashboard to control panel show or hide behavior when a token is set.

Drilldown defaults and customization

Some drilldown components have default settings. Depending on the component, you can use the drilldown editor or Simple XML to customize them.

Drilldown component	Default configuration	Where to customize
Enabled?	If you are building a new visualization or dashboard, drilldown is disabled by default. If you are migrating existing dashboards to software version 6.6 or later, your prior drilldown settings, including drilldown enablement by default, are retained.	Enable or disable drilldown using the drilldown editor or in Simple XML.
Element in the visualization where drilldown is enabled	Varies by visualization. For example, you can enable drilldown on table rows or on single table cells to capture more specific clicked values. Check the Simple XML reference for defaults and options.	Use Simple XML to adjust the drilldown location.
Browser tab where linked searches, dashboards, or URLs open	In the drilldown editor, the option to open in a new tab is selected by default. In Simple XML, drilldown opens in the same tab by default.	In the drilldown editor, you can opt out of opening the drilldown target in a new tab. In Simple XML, add the target="blank" attribute to a <link> to open the target in a new tab.

Default settings and source code synchronization

Drilldown is disabled by default in new dashboard content. To disable drilldown, an <option name="drilldown">none</option> Simple XML element is added to visualizations that you save to a dashboard.

To avoid synchronization issues, do not delete this <option> from your dashboard source code. You can use the drilldown editor to change drilldown configurations or edit the <option name="drilldown"> element without deleting it.

Access the drilldown editor

You can use the drilldown editor to enable or configure drilldown actions. Some advanced configurations, such as conditional linking, are available only in Simple XML.

Steps

1. In the dashboard where you want to configure drilldown, click Edit.
2. Find the panel where you are adding or updating drilldown. Click the additional options icon at the right. Select Edit Drilldown.
   
3. Use the editor to enable and configure drilldown actions.

For details on configuring specific drilldown actions in the drilldown editor and in Simple XML, see the options and linked topics in Choose a drilldown action.