Dashboards & Visualizations

In a bar chart dashboard, how edit an in-page drilldown to change the token value and perform a search within the same panel?

mblauw
Path Finder

Hi all,

I'm currently working on a dashboard in which a bar chart is shown. I want the drilldown to change the token value and do a search within the same panel (just as the submit button) when I click a bar. Currently, it brings me to the "search" page, where it pastes the clicked bar before the first pipe character.

This is my code:

<drilldown>
   <condition match="'overview_tok' == provider">
      <unset token="provider"></unset>
      <set token="provider">$click.value$</set>
   </condition>
   <condition match="'overview_tok' == partner">
      <set token="partner">$click.value$</set>
   </condition>
   <condition match="'overview_tok' == prefix">
      <set token="prefix">$click.value$</set>
   </condition>
</drilldown>

I've tried several settings, such as first unsetting the token and later setting it again, but noting seems to work. I'm trying to avoid using the Sideview Utils modules if it can be possible in another manner.

0 Karma

cmerriman
Super Champion

you'll want to use depends and rejects. try something like this

 <row>
    <panel>
      <chart rejects="$origin$" >
        <search>
          <query>...</query>
        </search>
        <drilldown>
          <set token="origin">$row.<fieldname>$</set>
        </drilldown>
      <option....>
     </chart>
 </panel>
<panel>
   <chart depends="$origin$" rejects="$next$">
        <search>
          <query>...</query>
        </search>
        <drilldown>
          <set token="next">$row.<fieldname>$</set>
        </drilldown>
       <option....>
 </chart>
0 Karma

mblauw
Path Finder

Actually, I don't want the charts to be depedent on certain token fields, but I want the charts to be adjusted to the token applies, such as it would react on changing the value in the dropdown menu.

Do you maybe have any idea on how this would be possible?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@mblauw - Just so you know, there is special markup language on this site so certain symbols will transform your post, such as the < > symbols. If you're posting sample code and wish to show the < >, simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar. That is how I was able to edit your post so that your code would properly display.

0 Karma

niketn
Legend

@mblauw... Will you be able to add any details from your search or screenshot of your visualization?
Also which version of Splunk are you on? Is it 6.5?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mblauw
Path Finder

Sorry for the markup language, I did not knew of that!

Of course! I've added a picture of my visualization to this post. I use an accelerated dashboard for the data input values, so just say Partner=$provider$, where it will be * for all providers won't work unfortunately..

The graph "meetcompleetheid" has columns being split by provider. I want users to be able to hit any of the bars so that the "Provider" token (which can also be toggled from the drop-down menu above) will be changed. Below, also my code can be seen upto the first panel: (The .... replaces a couple of lines of which I think won't be relevant to this case..)

<form>
  <label>ndw</label>
  <search id="ndw_data_main2">
    <query>index=ndw Provider=* Partner=* Prefix=*
  | stats values(Nageleverd) as "Nageleverd" values("Ontvangen") as "Ontvangen"  values("Niet ontvangen") as Niet_ontvangen values("onder_40s") as onder_40s values("t_0s") as t_0s values("Normale verkeersdata") as "Normale_verkeersdata" values("Geen verkeer verkeersdata") as "Geen_verkeer_verkeersdata" values("Herhalingen") as "Herhalingen" values("Fout berichten") as "Foutberichten" by _time Provider Partner Prefix</query>
    <sampleRatio>1</sampleRatio>
  </search>
  <search id="ndw_data_main" base="ndw_data_main2">
    <query>stats $calc_method$(Nageleverd) as "Nageleverd" $calc_method$("Ontvangen") as "Ontvangen"  $calc_method$("Niet_ontvangen") as Niet_ontvangen $calc_method$("onder_40s") as onder_40s $calc_method$("t_0s") as t_0s $calc_method$("Normale_verkeersdata") as "Normale_verkeersdata" $calc_method$("Geen_verkeer_verkeersdata") as "Geen_verkeer_verkeersdata" $calc_method$("Herhalingen") as "Herhalingen" $calc_method$("Foutberichten") as "Foutberichten" by $overview_tok$</query>
  </search>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="overview_tok" searchWhenChanged="false">
      <label>Overzicht per...</label>
      <choice value="Provider">Provider</choice>
      <choice value="Partner">Opdrachtgever</choice>
      <choice value="Prefix">Contract</choice>
      <choice value="Type">Datatype</choice>
      <choice value="Techniek">Techniek</choice>
      <choice value="_time">Tijd</choice>
      <default>Provider</default>
      <initialValue>Provider</initialValue>
    </input>
    <input type="dropdown" token="calc_method" searchWhenChanged="false">
      <label>Berekenmethode</label>
      <choice value="avg">Gemiddelde</choice>
      <choice value="latest">Laatste</choice>
      <default>avg</default>
      <initialValue>avg</initialValue>
    </input>
    <input type="time" token="time_tok" searchWhenChanged="false">
      <label>Datum</label>
      <default>
        <earliest>1483218000</earliest>
        <latest>1483225200</latest>
      </default>
    </input>
    <input type="dropdown" token="provider" searchWhenChanged="false">
      <label>Provider</label>
      <fieldForLabel>Provider</fieldForLabel>
      <fieldForValue>Provider</fieldForValue>
      <search base="ndw_data_main2">
        <query>top Provider</query>
      </search>
      <choice value="*">Alle</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="partner" searchWhenChanged="false">
      <label>Opdrachtgever</label>
      <fieldForLabel>Partner</fieldForLabel>
      <fieldForValue>Partner</fieldForValue>
      <search base="ndw_data_main2">
        <query>top Partner</query>
      </search>
      <choice value="*">Alle</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="prefix" searchWhenChanged="false">
      <label>Contract</label>
      <fieldForLabel>Prefix</fieldForLabel>
      <fieldForValue>Prefix</fieldForValue>
      <search base="ndw_data_main2">
        <query>top Prefix</query>
      </search>
      <choice value="*">Alle</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <input type="checkbox" token="meetcompleetheid" searchWhenChanged="true">
        <label>Meetcompleetheid</label>
        <choice value="meetcompleetheid">Laat zien</choice>
        <default>meetcompleetheid</default>
        <initialValue>meetcompleetheid</initialValue>
        <delimiter> </delimiter>
      </input>
      <input type="checkbox" token="levertijd" searchWhenChanged="true">
        <label>Levertijd</label>
        <choice value="levertijd">Laat zien</choice>
        <default>levertijd</default>
        <initialValue>levertijd</initialValue>
        <delimiter> </delimiter>
      </input>
      <input type="checkbox" token="bruikbaarheid" searchWhenChanged="true">
        <label>Bruikbaarheid</label>
        <choice value="bruikbaarheid">Laat zien</choice>
        <default>bruikbaarheid</default>
        <initialValue>bruikbaarheid</initialValue>
        <delimiter> </delimiter>
      </input>
    </panel>
  </row>
  <row>
    <panel depends="$meetcompleetheid$">
      <title>Meetcompleetheid</title>
      <chart>
        <search base="ndw_data_main">
          <query>fields $overview_tok$ "Nageleverd" "Niet_ontvangen" "Ontvangen"
          | rename Niet_ontvangen as "Niet ontvangen"</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        .....
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <condition match="'overview_tok' == provider">
            <unset token="provider"></unset>
            <set token="provider">$click.value$</set>
          </condition>
          <condition match="'overview_tok' == partner">
            <set token="partner">$click.value$</set>
          </condition>
          <condition match="'overview_tok' == prefix">
            <set token="prefix">$click.value$</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...