Dashboards & Visualizations

drilldown of the values

splunkpoornima
Communicator

I got the following output by using the below code...

index values(sources)

main c://taskmanager/taskmanager_log

list continues....

<?xml version='1.0' encoding='utf-8'?>

index=*|chart values(source) by index /app/search/flashtimeline?q=values(source)=$row.source$|transaction TaskBP startswith=START endswith=Succeeded|table TaskBP Duration

My requirement is if click the specific source i want see the query in the search ber as

index="main" source="c://taskmanager/taskmanager_log"|transaction TaskAction startswith=START endswith=Succeeded|

plz verify the code..and give suggestion

Tags (1)
0 Karma

Leo
Splunk Employee
Splunk Employee

try this:
...
index=|chart values(source) **as source* by index

/app/search/flashtimeline?q=index=$row.index$ source=$row.source$|transaction TaskBP startswith=START endswith=Succeeded|table TaskBP Duration
...

0 Karma

Leo
Splunk Employee
Splunk Employee

Also, note that this will only work on Splunk 5.0
If you're on an older version, you should use advanced xml drilldown.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...