Creating a custom drilldown

A drilldown is a query built using values from a previous query. The module ConvertToDrilldownSearch will build a query automatically from the table or graph that it is nested inside. Unfortunately, this only works well when the query is fairly simple, and when you want to see raw events. To build a custom drilldown, we combine intentions and the nested nature of modules.

Building a drilldown to a custom query

Looking back at our chart in the Reusing a query section, let's build a custom drilldown that shows the top instances of another field when it is clicked on.

Here is an example dashboard that draws a chart and then runs a custom query when clicked on:

<view template="dashboard.html"> <label>Chapter 8 - Drilldown ...

Get Implementing Splunk now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.