Hello, I have developed a relatively simple dashboard that measures the sentiment of RSS feeds that are indexed into my Splunk web version. Currently I am not able to get my Drilldown capability to work. I want the dashboard panels to work as follows: initial panel displays overall sentiment of all articles in a timechart that has drilldown capability. If someone wishes to see each individual event from a specific moment in time (they may be curious as to why sentiment is unusually high or low) they click on that moment in time, then the chart below populates a column chart that displays the sentiment of each article in that moment of time (y-axis would be sentiment and x axis would be article titles). My first panel works perfectly but my second column chart panel doesn't seem to respond to clicking on a column in the first. I have drilldown capability enabled. Here is my source code:
<chart>
<title>Sentiment Over Time</title>
<searchString>index = rss_2 | dedup link | sentiment imdb title | timechart avg(sentiment)</searchString>
<earliestTime>0</earliestTime>
<latestTime>now</latestTime>
<drilldown>
<set token="clicked_earliest">$earliest$</set>
<set token="clicked_latest">$latest$</set>
</drilldown>
</chart>
<chart>
<title>Individual Article Sentiment</title>
<searchString>index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment)</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
</chart
Any help would be greatly appreciated
This has been solved. In my second panel I changed the search string to:
index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click_earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.
This has been solved. In my second panel I changed the search string to:
index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click_earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.
I think you want to use the tokens that you created in the drilldown set elements: "clicked_earliest" and "clicked_latest"
So the second chart would look like:
<chart>
<searchString>index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment)</searchString>
<earliestTime>$clicked_earliest$</earliestTime>
<latestTime>$clicked_latest$</latestTime>
</chart>
Okay, progress made. When I click on the initial dashboard now i get "Error in 'stats' command: The argument '1416373200' is invalid." any clue here? I think it may be trying to take the sentiment of the 1st dashboard's sentiment values instead of the titles and that is screwing things up.