Chart that displays name, but drilldown for ID

tmortiboy · ‎02-07-2017

Say I have the fields id and name, I would like to produce a chart that show the count by name, so it is readable by the user of the dashboard.
The problem is that I would like to use the drill down on the chart to set a token based on the id for that row.

Ive tried using a stats query like so:

index=myindex *
| stats count by name id

and then in the xml:

<option name="charting.data.fieldShowList">["name","count"]</option>

however, the drill down cannot access the id field, and it just populates the input with the literal string "$row.id$"

<drilldown>
  <condition field="*">
    <set token="form.id">$row.id$</set>
  </condition>
</drilldown>

niketn · ‎07-10-2017

@tmortiboy, you should actually have used fieldHideList to hide id from being displayed and yet drilldown on the same.

<option name="charting.data.fieldHideList">["id"]</option>

Then use the id field in your drilldown:

 <drilldown>
     <set token="form.id">$row.id$</set>
 </drilldown>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

tmortiboy · ‎07-10-2017

Unfortunately, this produces the same affect as charting.data.fieldShowList, setting the value of the input to the literal string $row.id$ instead of the actual ID.

niketn · ‎07-10-2017

Hi @tmortiboy, sorry hidden fields in chart are not available for drilldown. The same in table can be used for drilldown. Following is run anywhere example through Splunk'd splunkd_ui_access logs which can drilldown based on hidden field uri:

  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd_ui_access uri=* uri_path=*
| stats count by  uri_path uri
| sort - count
| head 10</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">cell</option>
        <fields>uri_path, count</fields>
        <drilldown>
          <set token="tok_uri">$row.uri$</set>
          <set token="tok_uri_path">$row.uri_path$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        tok_uri: $tok_uri$
        &lt;br/&gt;
        tok_uri_path: $tok_uri_path$
      </html>
    </panel>
  </row>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn · ‎07-10-2017

In your case you need chart with drilldown to more than one field while hiding them from being displayed in legend (second field is anyways not displayed anywhere on the chart upon hovering except for a label in the legend)

  <row>
    <panel>
      <chart id="hideFirstLegend">
        <search>
          <query>index=_internal sourcetype=splunkd_ui_access uri=* uri_path=*
| stats count by  uri_path uri
| sort - count
| head 10</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.data.fieldShowList">[uri_path, uri, count]</option>
        <option name="charting.chart">column</option>
        <drilldown>
          <set token="tok_uri">$row.uri$</set>
          <set token="tok_uri_path">$row.uri_path$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <style>
          #hideFirstLegend .highcharts-legend-item:nth-child(1) {
              visibility: hidden !important;
          }          
        </style>
        tok_uri: $tok_uri$
        &lt;br/&gt;
        tok_uri_path: $tok_uri_path$
      </html>
    </panel>
  </row>

The following CSS Style override hides the first Legend in the chart named id="hideFirstLegend"

        <style>
          #hideFirstLegend .highcharts-legend-item:nth-child(1) {
              visibility: hidden !important;
          }          
        </style>

Please see if this fits your needs, or if you can use table instead to do this cleanly without CSS.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Chart that displays name, but drilldown for ID

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics!

New in Observability Cloud - Explicit Bucket Histograms