how to drill down or drill up in a dashboard, based on user selection, in splunk

Question

I am new to splunk and need some help. I need to create a dashboard to drill down and drill up based on selection. For eg, i have a company's org info along with their kpi scores. If i have to drill down/drill up based on selection, how can i do it? Here is the sample data for your reference.

userid KPI Score Manager_id Org_structure

abcd12 4 Manager1 abcd12/Manager1/Director1/VP1/CIO
abcd34 3 Manager1 abcd34/Manager1/Director1/VP1/CIO
abcd56 9 Manager1 abcd56/Manager1/Director1/VP1/CIO
abcd78 10 Manager1 abcd78/Manager1/Director1/VP1/CIO
abcd90 8 Manager1 abcd90/Manager1/Director1/VP1/CIO
user001 7 Manager2 user001/Manager2/Director1/VP1/CIO
user002 8 Manager2 user002/Manager2/Director1/VP1/CIO
user003 6 Manager2 user003/Manager2/Director1/VP1/CIO

Manager1 KPI will be an average of all his reportee's and so on. Director1 KPI will be an average of all his direct reportees and their reportees. (In this case average of Manager1 and Manager 2 KPI). Can someone please share how we can do it?

I expect the output of Manager1 KPI followed by other info. If i drill up, it should calculate all. Any idea how we can achieve this?

Answer 1

What do you mean by "drill up"? Splunk doesn't have such a concept.

I probably would approach this by splitting the Org_structure field into components and letting the user choose which component to use for grouping. In this example, $component$ is the token selected by user (from a dropdown, perhaps) and contains one of "user", "manager", "director", "vp", or "cio".

... | eval components=split(Org_structure, "/") 
| eval user=mvindex(components, 0), manager=mvindex(components, 1), director=mvindex(Org_structure, 2), vp=mvindex(components, 3), cio=mvindex(components, 4) 
| stats avg(KPIScore) as KPIScore by $component$