Implementing Splunk - Second Edition

Creating a custom drilldown

A drilldown is a query built using values from a previous query. The ConvertToDrilldownSearch module will build a query automatically from the table or graph that it is nested inside. Unfortunately, this only works well when the query is fairly simple and when you want to see raw events. To build a custom drilldown, we will combine intentions and the nested nature of modules.

Building a drilldown to a custom query

Looking back at our chart in the Reusing a query section, let's build a custom drilldown that shows the top instances of another field when it is clicked on.

Here is an example dashboard that draws a chart and then runs a custom query when clicked on:

<view template="dashboard.html"> <label>Chapter 9 - Drilldown ...