Dashboards & Visualizations

How do I set the axis title of my drilldown chart to the value I just clicked on?

erydberg
Splunk Employee
Splunk Employee

I want to set the x-axis title of my drilldown chart to the value of the argument I'm passing to the next search. I've tried the xml below, but that set's the label to "$click.value$" instead of the value. How do I set the axis title to the value of the click?

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Group" autoRun="True">
    <param name="savedSearch">savedsearch</param>
    <param name="useHistory">False</param>
    <module name="ResultsHeader">
        <param name="entityName">scanned</param>
        <param name="entityLabel">Events</param>
        <module name="SimpleResultsTable">
            <param name="count">100</param>
            <param name="displayMenu">True</param>
            <param name="drilldown">row</param>
            <module name="ConvertToIntention">
                <param name="intention">
                    <param name="name">addterm</param>
                    <param name="arg">
                        <param name="arg1">$click.value$</param>
                    </param>
                </param>
                <module name="HiddenSavedSearch">
                    <param name="savedSearch">savedsearch2</param>
                    <module name="JobProgressIndicator"/>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                    </module>
                    <module name="HiddenChartFormatter">
                        <param name="chart">column</param>
                        <param name="chart.stackMode">stacked</param>
                        <param name="primaryAxisTitle.text">$click.value$</param>
                        <module name="FlashChart">
                            <param name="width">100%</param>
                        </module>
                    </module>
                </module>
            </module>
        </module>
    </module>
</module>

Thanks!

Tags (2)

sideview
SplunkTrust
SplunkTrust

HiddenChartFormatter can not do $foo$ substitution. Actually among the core Splunk modules only a couple can -- ConvertToIntention and SimpleResultsHeader.

However if you install Sideview Utils, it contains a number of custom modules. Once the app is installed, you can mix and match the old modules with the new, and use as many or as few of the Sideview modules as you like. And with the Sideview modules, you can substitute dynamic values (aka use $foo$ tokens) into practically any module param.

In this particular case, since you want to take the key $click.value$ and end up basically renaming it to $charting.primaryAxisTitle.text$, you'd want to use the ValueSetter module, which is a sort of utility module that comes in handy sometimes.

<module name="ValueSetter">
  <param name="name">primaryAxisTitle.text</param>
  <param name="value">$click.value$</param>

You can stitch that in either above or below HiddenChartFormatter and it'll basically make the axis title say the selected value from the SimpleResultsTable.

You can get the older 1.3 version from Splunkbase with an LGPL license, or you can evaluate the 2.0 version from [http://sideviewapps.com/apps/sideview-utils/ the Sideview site].

jedatt01
Builder

If i'm understanding the question correctly you should be able to replace $click.value$ with $click.name$

$click.name$

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...