In my search
MYSearch|chart avg(mu) over _time by vmsid
Now I want to pass vmsid value to my next view. I have tried using sideview Redirector module and splunk ViewRedirector module but it is passing time value not vmsid.
Thanks,
Disha
For timecharts that are split by another field -- in this case by vmsid
, to reference the selected value of the "by field" you should use $click.name2$.
It's confusing to remember which keys to use with the charts, but they work in a very analogous way to the table drilldowns. So you can picture a SimpleResultsTable or a Table module being right where the chart module is. Then with the table modules you know that $click.value$ will always be the first column's value, and with a timechart the first column's value is always "_time". So in this way you can sort of explain why your config as written is always passing the time. 😃
In many other situations there are $foo$ keys added by Sideview Utils to make things easier or more intuitive, but in the case of grabbing the selected split-by field value from a chart or table, I'm afraid $click.name2$ is still the only way. Granted, if you were interested in vmsid="selected_vmsid_value", you could use $click.searchTerms$.
Also, as one final note beware that field names are always case sensitive and that goes here too. So VMSID is not equivalent to vmsid.
For timecharts that are split by another field -- in this case by vmsid
, to reference the selected value of the "by field" you should use $click.name2$.
It's confusing to remember which keys to use with the charts, but they work in a very analogous way to the table drilldowns. So you can picture a SimpleResultsTable or a Table module being right where the chart module is. Then with the table modules you know that $click.value$ will always be the first column's value, and with a timechart the first column's value is always "_time". So in this way you can sort of explain why your config as written is always passing the time. 😃
In many other situations there are $foo$ keys added by Sideview Utils to make things easier or more intuitive, but in the case of grabbing the selected split-by field value from a chart or table, I'm afraid $click.name2$ is still the only way. Granted, if you were interested in vmsid="selected_vmsid_value", you could use $click.searchTerms$.
Also, as one final note beware that field names are always case sensitive and that goes here too. So VMSID is not equivalent to vmsid.
ThankYou very much.