Greetings fellow splunkers 🙂
I am trying to get a dashboard that will have two charts on it. The top chart will show monthly counts and the bottom chart will show daily counts for the most recent month from the top chart when the dashboard is first loaded, and then show the daily counts for the month that is clicked for the drilldown action.
I used the example dashboard "In-Page Drilldown with Perma-linking" as a reference and I'm close to what I want, but not quite there.
The way that the example works is that the second chart is hidden until something is chosen from the top chart. What I want to have is both charts displayed when the page loads and have the second chart use the most recent month that is returned in the top chart to drive the results.
I have it working to the point where the top chart will display properly, but the bottom chart sits at "Search is waiting for input" until a month is selected from the top chart. The "In-Page Drilldown with Perma-linking" uses the "depends" tag to hide the second chart until something is chosen from the top chart. This is NOT what I want. What I want is for the bottom "Daily" chart to show the values for the most recent month that is returned in the top "Monthly" chart when the dasboard is first loaded.
What I am looking for is a way to set the value of the token being used to drive the bottom "Daily" chart to be the last month that is returned in the top "Monthly" chart. If there is a different approach that I should be using to achieve my goal I'm open to changing things.
Here is the simpleXML from my dashboard as it stands now. I am using version 6.1.1. Any help is much appreciated!
<dashboard>
<input type="text" token="Month_var" searchWhenChanged="true"/>
<label>Contextual Drilldown Simple</label>
<description/>
<row>
<panel>
<chart>
<title>Monthly</title>
<searchString>index=mytestidx1 sourcetype=myteststats | eval Month=strftime(_time,"%Y-%m") | eval Process_Time=(time_thing_end-time_thing_start) | chart count(eval(Process_Time>20)) AS >_20_seconds, count(eval(Process_Time>10 AND Process_Time<=20)) AS 20_seconds, count(eval(Process_Time>5 AND Process_Time<=10)) AS 10_seconds, count(eval(Process_Time<=5)) AS 5_seconds by Month</searchString>
<option name="charting.chart">column</option>
<drilldown>
<set token="Month_var">$row.Month$</set>
<set token="form.Month_var">$row.Month$</set>
</drilldown>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">all</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<title>Daily</title>
<searchString>index=mytestidx1 sourcetype=myteststats | eval Day=strftime(_time,"%d") | where strftime(_time,"%Y-%m")="$Month_var$" | eval Process_Time=(time_thing_end-time_thing_start) | chart count(eval(Process_Time>20)) AS >_20_seconds, count(eval(Process_Time>10 AND Process_Time<=20)) AS 20_seconds, count(eval(Process_Time>5 AND Process_Time<=10)) AS 10_seconds, count(eval(Process_Time<=5)) AS 5_seconds by Day</searchString>
<option name="charting.axisTitleX.text">Days in Month: $Month_var$</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">stacked</option>
</chart>
</panel>
</row>
</dashboard>
... View more