Splunk Search

How to capture Y-axis value for drill down in column chart?

viswanathsd
Path Finder

fieldname="$row.$" with and without quotes both are not working.
Fields values were renamed .Tried with both the values still didn't capturing the value.

Tags (2)
0 Karma
1 Solution

jayannah
Builder

chart (event tokens):
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The clicked field name is the name of the field or series for the y-Axis if present (similar to click.name2). If the name of the field or series is not available the field or category for the x-axis is used (click.name).

Data Property Description
click.name Name of the field or category for the x-axis. Not available when the legend has been clicked.
click.value Value of the field or category for the x-axis. Not available when the legend has been clicked.
click.name2 Name of the field or series for the y-axis.
click.value2 Value of the field or series for the y-axis. Not available when the legend has been clicked.
row. Any field values along the y-axis at the same point as the click on the x-axis. Not available when the legend has been clicked.
row. Value of the x-axis. Not available when the legend has been clicked.
earliest/latest Time range of the clicked chart segment, or if not applicable, the time range of the search.

For more details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/PanelreferenceforSimplifiedXML

View solution in original post

jayannah
Builder

chart (event tokens):
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The clicked field name is the name of the field or series for the y-Axis if present (similar to click.name2). If the name of the field or series is not available the field or category for the x-axis is used (click.name).

Data Property Description
click.name Name of the field or category for the x-axis. Not available when the legend has been clicked.
click.value Value of the field or category for the x-axis. Not available when the legend has been clicked.
click.name2 Name of the field or series for the y-axis.
click.value2 Value of the field or series for the y-axis. Not available when the legend has been clicked.
row. Any field values along the y-axis at the same point as the click on the x-axis. Not available when the legend has been clicked.
row. Value of the x-axis. Not available when the legend has been clicked.
earliest/latest Time range of the clicked chart segment, or if not applicable, the time range of the search.

For more details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/PanelreferenceforSimplifiedXML

helenashton
Path Finder

I think all you are missing is putting the column heading in, i.e. $row.host$ (or whatever).

If it isn't this, then are you using simple or advanced XML? Can you share the appropriate part of the XML?

0 Karma

viswanathsd
Path Finder

No,it will populate and used for x axis values,it worked fine.

0 Karma

viswanathsd
Path Finder

abc_xxx_summary.transaction_name field value is not caturing when I clicked

    <link>
      <![CDATA[

            /app/on_b/search?q=search%20index%3Donb%20sourcetype%3Depfapp%20OnB-*%20abc_xxx_summary.transaction_name%3D"$row.abc_xxx_summary.transaction_name$"%20%7Cbucket%20span%3D1m%20_time%7Cchart%20count%20as%20Errors%20OVER%20_time&earliest=&latest=&display.general.type=statistics
                                ]]>
    </link>      
 </drilldown>
0 Karma

helenashton
Path Finder

Am I right in assuming when you click on the link you see "$row.abc_xxx_summary.transaction_name$" in the actual link opened?
If so, I think the problem is that you are using CDATA and that the tokens might not be populated inside this. Can you check?

0 Karma

viswanathsd
Path Finder

Thanks for the response.
It was typo,I used $row.fieldname$ and using simple xml.

0 Karma

helenashton
Path Finder

So can you share the XML - it should help us work out the problem?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...