Dashboards & Visualizations

In a bar chart dashboard, how edit an in-page drilldown to change the token value and perform a search within the same panel?

mblauw
Path Finder

Hi all,

I'm currently working on a dashboard in which a bar chart is shown. I want the drilldown to change the token value and do a search within the same panel (just as the submit button) when I click a bar. Currently, it brings me to the "search" page, where it pastes the clicked bar before the first pipe character.

This is my code:

<drilldown>
   <condition match="'overview_tok' == provider">
      <unset token="provider"></unset>
      <set token="provider">$click.value$</set>
   </condition>
   <condition match="'overview_tok' == partner">
      <set token="partner">$click.value$</set>
   </condition>
   <condition match="'overview_tok' == prefix">
      <set token="prefix">$click.value$</set>
   </condition>
</drilldown>

I've tried several settings, such as first unsetting the token and later setting it again, but noting seems to work. I'm trying to avoid using the Sideview Utils modules if it can be possible in another manner.

0 Karma

cmerriman
Super Champion

you'll want to use depends and rejects. try something like this

 <row>
    <panel>
      <chart rejects="$origin$" >
        <search>
          <query>...</query>
        </search>
        <drilldown>
          <set token="origin">$row.<fieldname>$</set>
        </drilldown>
      <option....>
     </chart>
 </panel>
<panel>
   <chart depends="$origin$" rejects="$next$">
        <search>
          <query>...</query>
        </search>
        <drilldown>
          <set token="next">$row.<fieldname>$</set>
        </drilldown>
       <option....>
 </chart>
0 Karma

mblauw
Path Finder

Actually, I don't want the charts to be depedent on certain token fields, but I want the charts to be adjusted to the token applies, such as it would react on changing the value in the dropdown menu.

Do you maybe have any idea on how this would be possible?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@mblauw - Just so you know, there is special markup language on this site so certain symbols will transform your post, such as the < > symbols. If you're posting sample code and wish to show the < >, simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar. That is how I was able to edit your post so that your code would properly display.

0 Karma

niketn
Legend

@mblauw... Will you be able to add any details from your search or screenshot of your visualization?
Also which version of Splunk are you on? Is it 6.5?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mblauw
Path Finder

Sorry for the markup language, I did not knew of that!

Of course! I've added a picture of my visualization to this post. I use an accelerated dashboard for the data input values, so just say Partner=$provider$, where it will be * for all providers won't work unfortunately..

The graph "meetcompleetheid" has columns being split by provider. I want users to be able to hit any of the bars so that the "Provider" token (which can also be toggled from the drop-down menu above) will be changed. Below, also my code can be seen upto the first panel: (The .... replaces a couple of lines of which I think won't be relevant to this case..)

<form>
  <label>ndw</label>
  <search id="ndw_data_main2">
    <query>index=ndw Provider=* Partner=* Prefix=*
  | stats values(Nageleverd) as "Nageleverd" values("Ontvangen") as "Ontvangen"  values("Niet ontvangen") as Niet_ontvangen values("onder_40s") as onder_40s values("t_0s") as t_0s values("Normale verkeersdata") as "Normale_verkeersdata" values("Geen verkeer verkeersdata") as "Geen_verkeer_verkeersdata" values("Herhalingen") as "Herhalingen" values("Fout berichten") as "Foutberichten" by _time Provider Partner Prefix</query>
    <sampleRatio>1</sampleRatio>
  </search>
  <search id="ndw_data_main" base="ndw_data_main2">
    <query>stats $calc_method$(Nageleverd) as "Nageleverd" $calc_method$("Ontvangen") as "Ontvangen"  $calc_method$("Niet_ontvangen") as Niet_ontvangen $calc_method$("onder_40s") as onder_40s $calc_method$("t_0s") as t_0s $calc_method$("Normale_verkeersdata") as "Normale_verkeersdata" $calc_method$("Geen_verkeer_verkeersdata") as "Geen_verkeer_verkeersdata" $calc_method$("Herhalingen") as "Herhalingen" $calc_method$("Foutberichten") as "Foutberichten" by $overview_tok$</query>
  </search>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="overview_tok" searchWhenChanged="false">
      <label>Overzicht per...</label>
      <choice value="Provider">Provider</choice>
      <choice value="Partner">Opdrachtgever</choice>
      <choice value="Prefix">Contract</choice>
      <choice value="Type">Datatype</choice>
      <choice value="Techniek">Techniek</choice>
      <choice value="_time">Tijd</choice>
      <default>Provider</default>
      <initialValue>Provider</initialValue>
    </input>
    <input type="dropdown" token="calc_method" searchWhenChanged="false">
      <label>Berekenmethode</label>
      <choice value="avg">Gemiddelde</choice>
      <choice value="latest">Laatste</choice>
      <default>avg</default>
      <initialValue>avg</initialValue>
    </input>
    <input type="time" token="time_tok" searchWhenChanged="false">
      <label>Datum</label>
      <default>
        <earliest>1483218000</earliest>
        <latest>1483225200</latest>
      </default>
    </input>
    <input type="dropdown" token="provider" searchWhenChanged="false">
      <label>Provider</label>
      <fieldForLabel>Provider</fieldForLabel>
      <fieldForValue>Provider</fieldForValue>
      <search base="ndw_data_main2">
        <query>top Provider</query>
      </search>
      <choice value="*">Alle</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="partner" searchWhenChanged="false">
      <label>Opdrachtgever</label>
      <fieldForLabel>Partner</fieldForLabel>
      <fieldForValue>Partner</fieldForValue>
      <search base="ndw_data_main2">
        <query>top Partner</query>
      </search>
      <choice value="*">Alle</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="prefix" searchWhenChanged="false">
      <label>Contract</label>
      <fieldForLabel>Prefix</fieldForLabel>
      <fieldForValue>Prefix</fieldForValue>
      <search base="ndw_data_main2">
        <query>top Prefix</query>
      </search>
      <choice value="*">Alle</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <input type="checkbox" token="meetcompleetheid" searchWhenChanged="true">
        <label>Meetcompleetheid</label>
        <choice value="meetcompleetheid">Laat zien</choice>
        <default>meetcompleetheid</default>
        <initialValue>meetcompleetheid</initialValue>
        <delimiter> </delimiter>
      </input>
      <input type="checkbox" token="levertijd" searchWhenChanged="true">
        <label>Levertijd</label>
        <choice value="levertijd">Laat zien</choice>
        <default>levertijd</default>
        <initialValue>levertijd</initialValue>
        <delimiter> </delimiter>
      </input>
      <input type="checkbox" token="bruikbaarheid" searchWhenChanged="true">
        <label>Bruikbaarheid</label>
        <choice value="bruikbaarheid">Laat zien</choice>
        <default>bruikbaarheid</default>
        <initialValue>bruikbaarheid</initialValue>
        <delimiter> </delimiter>
      </input>
    </panel>
  </row>
  <row>
    <panel depends="$meetcompleetheid$">
      <title>Meetcompleetheid</title>
      <chart>
        <search base="ndw_data_main">
          <query>fields $overview_tok$ "Nageleverd" "Niet_ontvangen" "Ontvangen"
          | rename Niet_ontvangen as "Niet ontvangen"</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        .....
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <condition match="'overview_tok' == provider">
            <unset token="provider"></unset>
            <set token="provider">$click.value$</set>
          </condition>
          <condition match="'overview_tok' == partner">
            <set token="partner">$click.value$</set>
          </condition>
          <condition match="'overview_tok' == prefix">
            <set token="prefix">$click.value$</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

alt text

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...