Splunk Search

Is there a code example to add a drilldown for a column chart to display a table?

lmartha
Explorer

We are using Splunk 6.0 version and trying to add drilldown to column chart to display table. I searched examples related to this but i did not find any code related to it.

Column chart is form aggregated values by day. on click it should display details in table format for that day.

Here are column chart search string
index="perf"(sourcetype="metrics") source="PERF" measure="Transaction over 5 sec"|eval Day = strftime(_time,"%x")| chart sum(metric.count) by Day

On click of any column it should take to new page with this search results of that day.
index="perf"(sourcetype="metrics") source="PERF" measure="Transaction over 5 sec" |table metric.tran, metric.count, metric.avg

I have installed Splunk App UI examples but it is not showing any code. Please provide documentation how to do this.

1 Solution

nfilippi_splunk
Splunk Employee
Splunk Employee

Try something like this:

<form>
  <label>DrilldownChart</label>
  <description/>
  <row>
    <chart>
      <searchString>index="perf" (sourcetype="metrics") source="PERF" measure="Transaction over 5 sec"|eval Day = strftime(_time,"%x")| chart sum(metric.count) by Day</searchString>
      <earliestTime>-7d@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.chart">column</option>    
      <option name="charting.drilldown">all</option>
      <drilldown>
        <link target="_blank"><![CDATA[search?q=index="perf"(sourcetype="metrics") source="PERF" measure="Transaction over 5 sec"  | table metric.tran, metric.count, metric.avg&earliest=$earliest$&latest=$latest$]]></link>
      </drilldown>
    </chart>
  </row>
</form>

View solution in original post

nfilippi_splunk
Splunk Employee
Splunk Employee

Try something like this:

<form>
  <label>DrilldownChart</label>
  <description/>
  <row>
    <chart>
      <searchString>index="perf" (sourcetype="metrics") source="PERF" measure="Transaction over 5 sec"|eval Day = strftime(_time,"%x")| chart sum(metric.count) by Day</searchString>
      <earliestTime>-7d@h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.chart">column</option>    
      <option name="charting.drilldown">all</option>
      <drilldown>
        <link target="_blank"><![CDATA[search?q=index="perf"(sourcetype="metrics") source="PERF" measure="Transaction over 5 sec"  | table metric.tran, metric.count, metric.avg&earliest=$earliest$&latest=$latest$]]></link>
      </drilldown>
    </chart>
  </row>
</form>

lmartha
Explorer

Thank you. It worked as expected.

0 Karma

strive
Influencer

If simple XML refer this link:
http://answers.splunk.com/answers/149839/multiple-drilldown-from-a-chart-to-a-table-to-a-table

If advanced XML, then include this:

<module name="FlashChart">
    <param name="width">100%</param>
    <module name="ViewRedirector">
      <param name="viewTarget">flashtimeline</param>
    </module>
</module>
0 Karma

lmartha
Explorer

Thank you for your response. I believe we are using simple xml. I tried the example you provided but it did not work as expected.here is the my code.

index="perf"(sourcetype="metrics") earliest=-7d@h source="PERF" measure="Transaction over 5 sec"|eval Day = strftime(_time,"%x")| chart sum(metric.count) by Day column all
0 Karma

strive
Influencer

You are using advanced xml or simple xml?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...