How can I use chart drilldown to pass multiple values from a column chart to another panel?

[andrewtrobec]

Hello all,

I have successfully managed to create a column chart and pass a clicked upon value to another panel through use of a token:

    <drilldown>
      <set token="token_tok">$click.value$</set>
    </drilldown>

What I'm trying to do is be able to select multiple column chart values and create the token so that it contains multiple values. Is this possible? So assuming I have a field named Field it would be great to do something like:

      <set token="token_tok">Field=$click.value$ OR Field=$click.value2$ OR Field=$click.value3$</set>

Thoughts?

Thank you and best regards,

Andrew

[DalJeanis]

See this page, section on Define tokens for multiselect inputs

http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens

... and here's an example where they worked out how to pass specific data using a slightly different method...

https://answers.splunk.com/answers/425948/how-to-create-a-token-that-points-to-multiple-valu.html

[andrewtrobec]

Thanks for the links!

I did some reading, but I'm still not sure how to construct a drill down so that it passes multiple values to an input. By clicking one column I only get one value assigned to $click.value$ meaning that I have to click on another column which will overwrite the first $click.value$. I'm trying to get it so that I can maintain the initial value, so something like:

 <drilldown>
   <set token="token_tok">$token_tok$,$click.value$</set>
 </drilldown>

I was hoping that I could pass those values to a multiselect input, but It just seems to just construct a string.

Do you know whether this sort of approach is feasible?

Thanks!

Andrew

[DalJeanis]

Yes, it constructs a string that drops into your query language. Define the token as a multiselect token, and try control-click to select multiple values.

[andrewtrobec]

I tried to control click on the column values but it doesn't work! I really though this was the solution! To convey what I'm trying to do, I've created a dashboard that you can replicate:

<form>
  <label>Drilldown Example</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="category_tok">
      <label>Category</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <delimiter>  OR </delimiter>
      <fieldForLabel>Category</fieldForLabel>
      <fieldForValue>Category</fieldForValue>
      <search>
        <query>| makeresults count=100000
| eval CategoryNumbers = round(((random() % 50)/(random() % 25)*100),0)
| sort CategoryNumbers
| eval Category = "Category " . CategoryNumbers
| dedup Category
| table Category</query>
      </search>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>Category="</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Random Pareto</title>
      <chart>
        <search>
          <query>| makeresults count=1000
| eval Category = "Category " . round(((random() % 50)/(random() % 25)*100),0)
| stats count by Category
| sort -count
| streamstats sum(count) as RunningTotal
| eventstats sum(count) as Total
| eval CumulativePercent = round((RunningTotal/Total)*100,2)
| fields - Total, RunningTotal</query>
          <sampleRatio>1</sampleRatio>
        </search>
        <drilldown>
          <set token="form.category_tok">$click.value$</set>
        </drilldown>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.maximumNumber">100</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">CumulativePercent</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <title>Random Metric Chart</title>
      <table>
        <search>
          <query>| makeresults count=10000
| eval Category = "Category " . round(((random() % 50)/(random() % 25)*100),0)
| search $category_tok$
| eval SubCategory = "SubCategory " . round(((random() % 10)/(random() % 25)*100),0)
| eval Metric = round((random() % 100)/(random() % 50))
| chart sum(Metric) as MetricSum over SubCategory by Category</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

The Category input at the top is a multiselect and can be interacted with. The Random Pareto chart displays Category on it's X axis. The Random Metric Chart chart is dependent on the Category input. To update the Random Metric Chart I can either set the values in the input, or I can click on a column in the Random Pareto chart.

My goal is to be able to click on multiple columns in the Random Pareto chart so that they are added as separate values in the Category input. Right now clicking a column will overwrite the entire input.

Any ideas?

Thanks!

Andrew