Clicking on chart legend messes up the search query for drilldown

[wwhitener]

I have a bar chart that is the result of a query with a split clause. When you click on the individual bars, everything is fine and the drilldown works flawlessly. When you click on the legend, one of the fields comes back null and the entire rest of the drilldown suffers.

Is there any special magic with drilldowns on legends? (Aside from simply not having them!)

Thanks!

[gdiogo]

Simply add a relevant condition in your drilldown :
<condition match="isnull($click.value$)">
It will allow you to single out the case where the user clicks on the legend...

I wonder if my answer is of any help though... Seems to be quite late and maybe it is not right version of Splunk anymore...

[wwhitener]

4.2.2. This is in an Advanced XML view I'm coding.

I've got a simple header showing me what values are being returned.

When clicking on a bar in my chart:

field1=correct value

field2=correct value

When clicking on the legend in my chart:

field1=correct value

field2=null

And so I get no results returned.

If I could only get past the field2=null--filter it out somehow or ignore it or alias it or something--then it would work....

Ideas?

[araitz]

Assuming you are using Advanced XML, I wrote a module called UnixDrilldown to handle this use case for the Unix app which might solve your problem. To use it, just install the unix app, restart, and then reference the module in your XML.

[araitz]

What version of the Unix app are you using? I should have specified that the latest version (4.5) is the one that contains the module.

[wwhitener]

In looking at the mem_dashboard AdvancedXML, I do not see the UnixDrilldown. ???? Perhaps going through the showsource is not what you meant?

[araitz]

I understand what you are saying. The same complaint, that clicking on the legend results in bad drilldown, was lodged against the unix app. To fix the behavior, I created the UnixDrilldown module, which is used on the mem_dashboard. You can use that view as an example and try to integrate the module into your view to solve the same problem. If you want to see the implementation details, check out UnixDrilldown.js.

[wwhitener]

The Advanced XML is looking at searches for a text log--a log4j log.

I do happen to have the unix app installed already, but could you give me a bit more detail? Like I said in my reply below, for every bar on the chart, it works. It's just when I click on the legend that the whole thing fails.

[piebob]

what version of Splunk are you running?
is this in the Search app, or in another app?