Dashboards & Visualizations

Advanced Chart Drilldown Question

jedatt01
Builder

I have a chart which I want to be able to click and drilldown to another chart. My problem is that I want to be able to define a hidden search criteria and don't want the click to add any terms to the search, I only want the top chart to pass the time range down to the drilldown chart.

ex. my drilldown hiddensearch

index="oriondata" app_name="YRI MW" | timechart count by app_name

After I click on my chart it adds test_field="test" to the search critera so then it looks like this

index="oriondata" app_name="YRI MW" test_field="test" | timechart count by app_name

how can I make splunk disregard the click value and just pass the time range?

Tags (3)
1 Solution

jedatt01
Builder

I figured it out. To pass only the time value I used intention. I removed one of the search terms from the original search and used intention with the addterm parameter to add it back into the search criteria. I really didn't need the $click.value$. I replaced that with a static value.
See code below.


sourcetype="orion_*_detail_daily" OR sourcetype="gomez_data" | eval
percent_avail=coalesce(percent_avail,avail) | eval tier =

if(sourcetype="Orion_Server_Detail_Daily","Server",if
(sourcetype="Orion_Application_Detail_Daily","Application","User")) | stats avg
(percent_avail) by tier

      <module name="ConvertToIntention">
        <param name="intention">
          <param name="name">addterm</param>
          <param name="arg">
            <param name="app_name">"YRI *MW*"</param>
          </param>
        </param>
               <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
              </module>
        </module>
       </module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

You actually don't need to do anything at all.

Assuming that the the first FlashChart is rendering a timechart, when the user clicks it, the argument that module passes to the downstream modules will already include the modified timerange.

So if you take out any HiddenSearch and the ConvertToIntention that you had tried, and just have FlashChart or other "dispatching" modules downstream from the first chart, the exact same search will automatically get dispatched, but using the modified timerange.

0 Karma

sideview
SplunkTrust
SplunkTrust

You've had the power all along. See "Key Techniques > inline drilldown > drilldowns with tables and charts". On that page there is an example of both 'table to chart' and 'chart to chart', although it's all pretty interchangeable. You can figure out from the example how to put tables downstream from charts, charts downstream from tables, HTML modules downstream from any, EventsViewer modules, etc... go nuts. The overall docs around linking and drilldown could use another rewrite and I'll break down and do that soon.

0 Karma

0waste_splunk
Communicator

@nick, i have sideview 2.5 and still i didn't find drilldown from chart to chart or chart to table. can you please add that in next release?

thanks

0 Karma

sideview
SplunkTrust
SplunkTrust

In Sideview Utils 2.0 (Note that 2.0 is no longer distributed under free licensing), the FlashChart and JSChart also have the same $click.fields.fieldName$ tokens that the SimpleResultsTable has. You're right though, the example page only uses tables. I'll add another exampel to 2.0. In the meantime You can write it yourself by following these steps:
1) build it using a SimpleResultsTable, but use only click.value / click.name2
2) Then replace the SimpleResultsTable with FlashChart or JSChart. the click.value/click.name2 behavior is identical across those 3 modules.

0 Karma

cphair
Builder

@nick, do you have any examples of drilling down from one chart to another? The examples in Sideview all use tables, and I wasn't sure of the syntax to modify parameters/search when "row" and "cell" don't really make sense.

0 Karma

jedatt01
Builder

I figured it out. To pass only the time value I used intention. I removed one of the search terms from the original search and used intention with the addterm parameter to add it back into the search criteria. I really didn't need the $click.value$. I replaced that with a static value.
See code below.


sourcetype="orion_*_detail_daily" OR sourcetype="gomez_data" | eval
percent_avail=coalesce(percent_avail,avail) | eval tier =

if(sourcetype="Orion_Server_Detail_Daily","Server",if
(sourcetype="Orion_Application_Detail_Daily","Application","User")) | stats avg
(percent_avail) by tier

      <module name="ConvertToIntention">
        <param name="intention">
          <param name="name">addterm</param>
          <param name="arg">
            <param name="app_name">"YRI *MW*"</param>
          </param>
        </param>
               <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
              </module>
        </module>
       </module>
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...