All Apps and Add-ons

Does the new Punchcard visualization in Splunk 6.4 Punchcard support standard token setting and drilldown?

sbob909
Explorer

I've got the new custom visualization Punchcard displayed just the way I want it to, but I can't seem to set a token when I click on a circle. For example, assume I have a query such as

... | table cluster node latency color

and then I use the following drilldown in my XML

    <drilldown target="Node Explorer">
      <set token="this_node">$row.node$</set>
      <link>node_explorer?form.node_input=$this_node$</link>
    </drilldown>

What gets passed to the target page is $row.node$, which tells me that the token isn't getting set properly on the click.

Do the new custom visualization support standard token setting? The doc is minimal. So I looked around, couldn't find others having this problem.

I'd appreciate any ideas. Thanks.

0 Karma
1 Solution

sbob909
Explorer

@magnew, thanks for the reply.

I did some more research on this and what it turned out to be was this. My query, which I had edited for this post to avoid confusion with other readers, was actually more like this:

| table cluster node latency color clusterNode

Note the 5th field, clusterNode. With other classic Splunk visualizations, I often rely on a field not represented in the visualization as the source for my drilldown link.

It turns out, with the new Punchcard visualization, using fields not shown in the visualization doesn't work. So I had to rework my drilldown link (and destination views) to use a combination of the first two fields (cluster, node) as the necessary values to get where I was going.

I hope this research helps others avoid similar miscues and lost time.

View solution in original post

0 Karma

sbob909
Explorer

@magnew, thanks for the reply.

I did some more research on this and what it turned out to be was this. My query, which I had edited for this post to avoid confusion with other readers, was actually more like this:

| table cluster node latency color clusterNode

Note the 5th field, clusterNode. With other classic Splunk visualizations, I often rely on a field not represented in the visualization as the source for my drilldown link.

It turns out, with the new Punchcard visualization, using fields not shown in the visualization doesn't work. So I had to rework my drilldown link (and destination views) to use a combination of the first two fields (cluster, node) as the necessary values to get where I was going.

I hope this research helps others avoid similar miscues and lost time.

0 Karma

magnew_splunk
Splunk Employee
Splunk Employee

Hello @sbob909,

The new visualizations do support standard token setting. I've just been trying this scenario with my own searches and the tokens seem to get set correctly on redirect. There is a little bit of a caveat: in the punchcard viz, if you click on an axis label, you will get tokens set for that axis, but not the other one, and vice versa. If you click on one of the circles, you will get tokens for both axes. Where are you clicking to cause the drilldown? Does clicking the other axis or a circle get you the right tokens?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...