Anyone have sample swql query for Drilldown widget in modern dashboard , explain how to use that drill down options?

Not yet, but this is fairly high on the list of "low priority stuff to figure out"

I was playing around with this today, but I wasn't able to get anything to show for the status icons. I'm sure the "entity" in "entity formatting" is a hint to what kinds of resources are supposed to be used with this widget, but I couldn't figure it out with limited testing. Some documentation from SW would be great on this one. I did end up with a query where I could drill down through a few custom properties which was pretty neat, but having over 50% of the real estate of the widget taken up by status counts I can't get to work makes me sad haha.

Got a direct answer to a direct question on this a little before 2024.2 released, which was that documentation is coming, but they werent satisfied with it as a feature yet so it's only really half-released, and docs would follow when it's a bit more ready

Please post what you've got so far though

Opened a ticket with TAC, below is the answer.. 

==

Thank you for the screenshot and the request details. 

As the Widget feature is fairly new. The support articles for the widget are being created, and is not yet released. 

Tested this one today. Works very strange.... But here is a query that works:

SELECT
N.caption as EntityName
,N.vendor
,CASE 
    WHEN n.Status=1 THEN 'up'
    WHEN n.Status=2 THEN 'critical' 
    WHEN n.Status=9 THEN 'unmanaged'
    ELSE 'unknown'
END as EntityStatus
,n.detailsurl as EntityLink
,'server' as EntityIcon
FROM Orion.Nodes as N
order by n.vendor, n.Caption

A couple of weird things:

The column names has to be named like that (Enityxxxx) Seems to be hard coded
Status has to be a text, and all small caps. "Up" does not work, has to be "up".
There is something called "EntityDetailedLink", don't know what it is and didn't get it to work
Added [machinetype] to try to group on another level, didn't work. Don't know why....

Feels like early beta to me.

Thanks for posting, that Up/up thing must've been frustrating to work out 

Thanks for the query, but its not working as expected from Drilldown widget, I had raised a case with TAC, as per them its document is going to be released soon with some examples..

Great work! I also took a stab at this, based on the examples provided by the new widgets created from this base Drilldown widget; e.g. AWSTopology and AzureTopologyWidget. However, after playing around with the 'UNION' approach to dissecting the various statuses, I realized I could do the same thing using your example as a base. For those who are interested, the Grouping section of the widget is key to drill-down aspect of this widget; don't do grouping in your SWQL query; allow the widget to do it for you.

One caveat is your use of the 'unmanaged' status, as the widget doesn't appear to recognize that as a valid entry. The only status values I've found that return a count are 'up', 'critical', 'warning' and 'unknown'. I'd love to hear if you have found it to work differently.

I also found that the Entityxxx reference doesn't really matter UNLESS you are using EntityLink, in which case the item you want to link must be named EntityName. I've tried other combinations to get the same result, but not with any success.

Finally, I messed around a bit with the EntityIcon values, but I've been unable to find any way to link them to an actual database entry. I have found that the following values resolve to an actual icon: 

• application
• server
• group
• switch
• firewall
• network
• database
• volume

Since this appears to have been designed for Cloud monitoring, that list makes some sense. I've been trying to come up with other values that may make sense in a cloud environment, but that's what I've managed so far. I used that information to give some different (albeit somewhat arbitrary) icon values based on category and vendor values, and this is my final result so far:

SELECT
N.caption as EntityName
,N.vendor
,CASE 
    WHEN n.Status IN (1) THEN 'up'
    WHEN n.Status IN(2, 12, 14) THEN 'critical' 
    WHEN n.Status IN (3, 9) THEN 'warning'
--  WHEN n.Status IN (0, 4) THEN 'unmanaged'
    ELSE 'unknown'
END as EntityStatus
,n.detailsurl as EntityLink
,CASE
    WHEN n.Category = 2 THEN 'server'
    WHEN n.Category = 1 AND n.Vendor LIKE 'Forti%' THEN 'firewall'
    WHEN n.Category = 1 AND n.Vendor NOT LIKE 'Forti%' THEN 'switch'
    ELSE 'network'
END AS EntityIcon
FROM Orion.Nodes as N
order by vendor, Caption

I grouped the results by Vendor. I haven't been able to figure out how to come up with a secondary 'status' value that would allow me to drill down to another level.

It's obviously a work in progress, but I love the concept! I did come up with a widget to show groups and group members (from Orion.ContainerMembers), which is what lead me down this path originally. Only goes one level, but it's a start!

Breaking ground!