How to pass two drilldown tokens, one for the month from a timechart to a new panel and display a stats count for a clicked value. I've got the clicked value token figured out but passing the Month for the clicked value on my timechart is giving me fits.
The main panel populates from a scheduled report. Here is my dashboard XML below :
<row>
<panel>
<title>Tickets By Category - Past 6 Months</title>
<chart>
<search ref="Tickets By Category - Past 6 Months"></search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">bottom</option>
<drilldown>
<set token="selectCategory">$click.name2$</set>
<set token="selectTime">$click.value$</set>
<set token="showDD">1</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<table depends="$showDD$">
<title>$selectCategory$ - $form._earliest$ - $form._latest$</title>
<search>
<query>index=test Tickets=* CategoryName="$selectCategory$" | dedup Tickets | stats count by CategoryName
| rename contact as Requester | head 10
| sort - count
| fields - CategoryName</query>
<earliest>$form._earliest$</earliest>
<latest>$form._latest$</latest>
</search>
<option name="refresh.display">progressbar</option>
<drilldown>
<unset token="showDD"></unset>
</drilldown>
</table>
</panel>
</row>
For reference my main panel report query is :
index=test Tickets=*
| dedup Tickets
| timechart span=1mon count by Category useother=f usenull=f
@johnward4,
When you click on a chart with time series, by default it provides $earliest$ and $latest$ time value which could be used for further filtering. If you need "Month" value, you could extract that using eval in the drilldown.
e.g.
<drilldown>
<set token="selectCategory">$click.name2$</set>
<eval token="selectTime">strftime($earliest$,"%m")</eval>
<set token="showDD">1</set>
</drilldown>
Reference : http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/PanelreferenceforSimplifiedXML#chart_2
Also, if you are not using $selectCategory$ anywhere else in the dashboard, you could use that in the depends
as well. You dont need a separate token showDD - it doesn't make any harm though