Dashboard: Split field into unknown number of separate fields and be clickable

[hvdtol]

Hi there,

I have challenge which i am not sure if this is possible in Splunk.

I have directory data with documents. On a dashboard i show a directory structure

...
| chart c by Directory extention
| addtotals fieldname="Total" labelfield=Directory col=t

Directory          doc    docx  dot Total
DIRA\DIRB     1462  1450 167 3079
Total                  1462  1450 167 3079

The user is able to click on a directory to drilldown and it shows the next subdirectory

Directory                                    doc     docx  dot    Total
DIRA\DIRB\DIRC1                1000   450    167    1617
DIRA\DIRB\DIRC2                462     1000   0        1462
Total                                           1462   1450   167   3079

next..
DIRA\DIRB\DIRC1\DIRX              900    0             166   1066
DIRA\DIRB\DIRC1\DIRY             100     1450      1        1551
Total                                                     1000    1450    167   2617

And so further...

My goal is this:
I would like my output to look like this: separate directory columns in chart lay-out
The reason is i want to be able to go-back to a higher directory level.
And this value should be clickable

dir1   dir2     dir3                   doc      docx  dot   Total
DIRA DIRB  DIRC1              1000    450   167  1617
DIRA DIRB  DIRC2               462      1000  0      1462

Is this somehow possible?

Regards,

Harry

[gcusello]

Hi @hvdtol,

I never used it, I only installed it on my pc to see it, but probably the Treewiz App could solve your need (https://splunkbase.splunk.com/app/5101/).

Ciao.

Giuseppe