Use drilldown for dashboard interactivity in Splunk Light
You might want to share additional data insights when users click on data points, table rows, or other visualization elements in a dashboard. Use drilldown to build this interactivity into your dashboards.
How drilldown works
Drilldown is a tool for configuring responses to user clicks on visualizations in a dashboard or form. Drilldown behavior is configured within individual visualizations. You can have separate drilldown configurations for each visualization in a dashboard. Depending on the visualization type, you can also enable drilldown on specific elements in a visualization, such as a table row or cell.
The drilldown actions that you configure happen when a user clicks the visualization element where the drilldown is enabled.
Link to a target
Drilldown actions can link a source dashboard or form to an external target that opens on a user click. The target can be a secondary search, another dashboard or form, or a website.
Trigger interactive behavior in the current dashboard
Drilldown action scan also trigger contextual changes in the same dashboard or form. For example, you can show or hide content depending on a clicked value.
Using tokens to customize a drilldown
Tokens are like programming variables. A token name represents a value that can change, such as a user selection in a form input. You can use a token name to access the value that it represents. In drilldown, you can use tokens to capture contextual values from the current dashboard or values from clicked elements. You might also define custom tokens to help implement interactive behavior.
You can pass token values to a target search, dashboard, or URL by configuring a drilldown to set tokens in the target to the captured source values. Setting token values in this way lets you show customized content in the target.
You can also use token values to trigger interactive changes in the current dashboard, such as content display or more specific search results. Configure elements in the current dashboard to listen for and respond to these changes.
Tokens available in drilldown
Several predefined token types representing dashboard events are available within a drilldown context. You can use these tokens to access clicked fields, search events, and other dynamic values.
See Token usage in dashboards in the Splunk Enterprise Dashboards and Visualizations manual for details on working with the following token types.
Form input change events
Form inputs use a token to represent the value that users select in the input. If your drilldown target is a form, you can pass a value from a source dashboard to the input token in the target form so that users see content customized for the selected value.
To determine the token name for a form input, check the Simple XML source code for that input.
Predefined tokens represent search progress and completion events. Include search event handlers inside the
<search> element for a visualization to get search job or result properties. You can use tokens to pass these values to the
Tokens set on page load
You can use an
<init> element to set token values when a dashboard loads in the browser. You can access token values from the
<init> element in a
You can access token values representing user pan and zoom or selection events in some chart types. See Chart controls in the Splunk Enterprise Dashboards and Visualizations manual for more information on working with these tokens.
Predefined click event tokens
Some tokens that you can use for drilldown are predefined in Splunk software. You can use these tokens to capture user actions or other values from a dashboard. For example, you can use the predefined
$click.value2$ token to capture a clicked table cell value.
See Predefined drilldown tokens in the Simple XML Reference in the Splunk Enterprise Dashboards and Visualizations manual for a list of predefined tokens available for each visualization.
In addition to predefined tokens, you can create custom tokens to help create dynamic or conditional display behavior. These tokens can represent other values that change, such as search results.
Choose a drilldown action
Choose a drilldown action depending on the type of interactive behavior that you want and the data insights that you are sharing with users.
|Action||Type||Behavior and configuration|
|Link to a search||Link to a target||Open a search page in the browser. A secondary search generates automatically to show results for the clicked value. You can also create a custom search.|
|Link to a different dashboard or form||Link to a target||Open a target dashboard or form in the browser. Use tokens to pass values to the target and show content customized to the clicked value or other values from the source.|
|Link to a URL||Link to a target||Open an external website in the browser. Pass token values from the source to the URL as query string parameters.|
|Manage token values in the current dashboard or form||Trigger interactivity in the current dashboard||Set, unset, or filter token values when a user clicks on an element in a dashboard or form.|
Instead of linking to a different location, use token value changes to configure interactive behavior in the same dashboard. For example, you can use
Drilldown defaults and customization
Some drilldown components have default settings. Depending on the component, you can use the drilldown editor or Simple XML to customize them.
|Drilldown component||Default configuration||Where to customize|
|Enabled?||If you are building a new visualization or dashboard, drilldown is disabled by default. If you are migrating existing dashboards to software version 6.6, your prior drilldown settings, including drilldown enablement by default, are retained.||Enable or disable drilldown using the drilldown editor or in Simple XML.|
|Element in the visualization where drilldown is enabled||Varies by visualization. For example, you can enable drilldown on table rows or on single table cells to capture more specific clicked values.
Check the Simple XML reference in the Splunk Enterprise Dashboards and Visualizations manual for defaults and options.
|Use Simple XML to adjust the drilldown location.|
|Browser tab where linked searches, dashboards, or URLs open||In the drilldown editor, the option to open in a new tab is selected by default.
In Simple XML, drilldown opens in the same tab by default.
|In the drilldown editor, you can opt out of opening the drilldown target in a new tab. In Simple XML, add the |
Default settings and source code synchronization
Drilldown is disabled by default in new dashboard content. To disable drilldown, an
Simple XML element is added to visualizations that you save to a dashboard.
To avoid synchronization issues, do not delete this
<option> from your dashboard source code. You can use the drilldown editor to change drilldown configurations or edit the
<option="drilldown"> element without deleting it.
Access the drilldown editor
You can use the drilldown editor to enable or configure drilldown actions. Some advanced configurations, such as conditional linking, are available only in Simple XML.
- In the dashboard where you want to configure drilldown, click Edit.
- Find the panel where you are adding or updating drilldown. Click the additional options icon at the right. Select Edit Drilldown.
- Use the editor to enable and configure drilldown actions.
For details on configuring specific drilldown actions in the drilldown editor and Simple XML, see the options and linked topics in Choose a drilldown action.
Create forms in Splunk Light
Use trellis layout to split visualizations in Splunk Light
This documentation applies to the following versions of Splunk® Light (Legacy): 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6