Configuring Drilldown from a Chart to Another Dashboard
In a dashboard, a user wants to click on a bar in a chart and navigate to another dashboard with relevant data for that bar. Which feature should they configure?
Quick Answer
Drilldown is the Splunk dashboard feature purpose-built for exactly this kind of interaction: turning a click on a visual element, like a bar in a chart, into a navigation event that carries context along with it. When drilldown is configured on a panel, clicking a data point captures the underlying field values associated with that point and passes them as tokens, which can then be used to filter the search on a target dashboard, so the user lands on relevant, pre-filtered data rather than a blank or generic view. This is configurable either through the visual Drilldown editor in the dashboard UI or directly through XML attributes on the chart element, giving the same result through two different authoring paths. The key idea to hold onto is that drilldown is specifically about connecting a click to a destination and passing data forward, which distinguishes it from features that only affect how a single panel displays its own results, such as formatting or coloring options, or from static links that don't carry any contextual field values with them. Whenever a question describes a user clicking on part of a visualization and expecting to land on a different, related view with matching context, that description is pointing directly at drilldown rather than any other dashboard configuration option.
⚠ Common exam trap
A common mix-up: candidates confuse 'Link to search' with drilldown because both involve clicking, but 'Link to search' opens a search window rather than navigating to a dashboard, which is the specific requirement in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Drilldown
Drilldown is the correct feature because it allows a user to click on a data point (e.g., a bar in a chart) and navigate to another dashboard, passing the relevant field values as tokens to filter the target dashboard's data. This is a built-in capability in Splunk dashboards, configurable via the 'Drilldown' editor or XML attributes like `drilldown` on chart elements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Drilldown
Why this is correct
Drilldown actions can set tokens and navigate to other dashboards.
- ✗
Link to search
Why it's wrong here
This opens a search, not a dashboard, and may not pass context.
- ✗
Custom URL
Why it's wrong here
Custom URLs are static and do not respond to user clicks.
- ✗
Tokens
Why it's wrong here
Tokens store values but do not inherently trigger navigation.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1001
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A dashboard designer wants to create a drilldown from one chart to another dashboard. Which TWO actions must be configured? (Select two.)
medium- A.Add a search command to the chart
- B.Set the source chart's drilldown to 'link to search'
- C.Enable dashboard permissions
- ✓ D.Set the target dashboard's token to accept the drilldown value
- ✓ E.Set the chart's drilldown action to 'link to dashboard'
Why D: Options D and E are correct because for a drilldown from one chart to another dashboard, you must set the source chart's drilldown action to 'link to dashboard' (option E) and configure the target dashboard to accept a token from the drilldown (option D). Option A is incorrect because adding a search command is not required for drilldowns. Option B is incorrect because 'link to search' opens a search, not a dashboard. Option C is not necessary; while dashboard permissions control access, they are not part of the drilldown configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.