How can I set a specific drilldown on a line chart based on the value of a field?

[dandaily]

My issue is that I have a line chart that shows the CPU usage from both linux and windows servers. If the user clicks on a windows server, I would like to have it drill down to a detailed dashboard for windows only servers. If the user selects a linux server, I want it to take them to the detailed dashboard for linux servers.

I looked into conditions, which might have worked if it had values. I have a field named "os" that defines the Operating system, and I wanted to use "row.os" as a token in the app name drilldown "/app/hnet_it_ops/helpnet_it_ops_$row.os$_server?form.server=$click.name2", but charts can't use fields outside of the x and y axis to my knowledge. Does anyone else have any solutions to be able to drilldown to separate links based on what is clicked?

<panel>
  <title>CPU - % Utilization</title>
  <chart>
    <title>Top 5 Results - 1min Refresh</title>
    <search>
      <query>(index=xxxx sourcetype=cpu cpu=all) OR (index=xxxx sourcetype=Perfmon:CPU host=* collection=CPU counter="% Processor Time") |  bin _time span=1m| eval pctUsed = 100-pctIdle | eval pctUsed=coalesce(pctUsed,Value) |eval Time=strftime(_time, "%H:%M")| chart max(pctUsed) over Time by host  WHERE max in top5 useother=f</query>
      <earliest>$TimePicker.earliest$</earliest>
      <latest>$TimePicker.latest$</latest>
    </search>
    <option name="refresh.auto.interval">60</option>
    <option name="height">450</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <drilldown>
      <link>
        <![CDATA[/app/hnet_it_ops/helpnet_it_ops_windows_server?form.server=$click.name2$]]>
      </link>
    </drilldown>
  </chart>
</panel>

[renjith_nair]

Hello,

What about setting a token based on clicked value and then display only the panel which is related to the clicked value using depends (contextual drilldown)

Refer here http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/Understandbasictableandchartdrilldownactions#C...

Further reference for dynamic token : http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/Understandbasictableandchartdrilldownactions#D...

[dandaily]

A contextual drilldown applies to a token that remains on the same dashboard. I need to drilldown to a different dashboard/form. If I am misunderstanding what you are saying, let me know.

[renjith_nair]

Yes! But have your tried this http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/Understandbasictableandchartdrilldownactions#S... . We have used similar and is working. What is the limitation if you use the mentioned example? In this case, you can use OS instead of sourcetype and then link to the detailed page.

[dandaily]

The limitation is with chart drilldown. The two fields I have to work with (X and Y axis) are host and pctUsed. I have not been able to find a way to use my field OS, because charts do not seem to allow drilldown outside of the x and y axis. Now if you are saying you can use a field not being charted, could you give a direct example of the code? The examples linked are from tables, which allow for drilldown on additional fields.