Dashboards & Visualizations

How to redirect to a URL when clicked on the circle marker

isplunk2999
Path Finder

Hi

I have a line-chart as shown in below screenshot. By default, the drilldown action redirects to the search page ,is it possible to create custom action to redirect to another URL when clicked on the circle markers?

I have explored the simpleXML option using the examples @https://splunkbase.splunk.com/app/1603 ,I mainly found examples related to linking a dashboard, form, or external website in response but I couldn't find an example that handles my use-case?

How can I do this without using fancy web tool kits ?please advise

0 Karma

niketn
Legend

@isplunk2999 try getting the Splunk Dashboard Examples App which contains several examples related to Splunk Dashboard including examples for Drilldown. Example for your use case is also present in the App. You can drilldown to External URLs depending n the clicked series.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

isplunk2999
Path Finder

Hey @niketnilay - I did mention in my original question that I did look @https://splunkbase.splunk.com/app/1603 , I couldn't find an example for my usecase,may be I missed it, do you mind pointing me the exact link you are talking about?

0 Karma

niketn
Legend

Drilldown Link to Custom URL

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DEAD_BEEF
Builder

Easiest way is to simply edit the Drilldown and edit the "On Click" action. Alternatively, you can edit the xml. Please accept as answer if this is the solution for future readers.
alt text

    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    ...
    ...
    <option name="trellis.size">medium</option>
    <drilldown>
      <link target="_blank">https://yourURL.com</link>
    </drilldown>
  </chart>

isplunk2999
Path Finder

Hey @DEAD_BEEF:

I need to click a different URL for each of the circle markers in the line graph, the URL's are stored in the same JSON and are fetched dynamically(they are not static)

My current query is as below, so, for example for the value "Analyze.Investigate.count"the URL is under "Analyze.Investigate.link"
Analyze.Review.count --> Analyze.Screen.link
Analyze.Screen.count --> Analyze.Screen.link

QUERY:
index=wifiengg_cat2 sourcetype=radar_statistics_data6 | chart values(Analyze.Investigate.count) as Investigate values(Analyze.Review.count) as Review values(Analyze.Screen.count) as Screen over _time

How do I fetch these links and add to the corresponding circle markers?

0 Karma

DEAD_BEEF
Builder

Why don't you put all these details in your initial question? You didn't specify that you needed conditional matches, you didn't state that you needed dynamic links. These are all important details that keep people from helping.

Anyway, you can read up on how to use conditional matches here (look at chart tokens).

This uses the name of the series to determine where the external URL

    <drilldown>
      <condition match="$click.name2$==&quot;Investigate&quot;">
        <link target="_blank">https://www.google.com</link>
      </condition>
      <condition match="$click.name2$==&quot;Screen&quot;">
        <link target="_blank">https://www.yahoo.com</link>
      </condition>
0 Karma

isplunk2999
Path Finder

@DEAD_BEEF - Sorry about not clear in the initial question, very new to this forum,trying to get hang of things,thanks for your guidance so far.

I insert the data in the following JSON format,each of the circle markers in the line graph represent the count field over _time for the respective series(names of series are Investiage,Screen,Review),you probably gave using the name series to determine the external URL just as an example but what I am looking for is determining the URL based on the count field and the URL is the corresponding change_link in the same JSON object?this is where I need your guidance

_raw = {

"Total_radar_count":"999",
"Analyze":{
    "Screen":{"count":110,"change_link":"change://problem/90811162&82639896&88776863&83703933"},
    "Investigate":{"count":069,"change_link":"change://problem/90811162&82639896&88776863&83703933"},
    "Review":{"count":106,"change_link":"change://problem/90811162&82639896&88776863&83703933"}
},
"timestamp": int(time.time())  # Can also use datetime.datetime.now().isoformat()

}

0 Karma

DEAD_BEEF
Builder

@niketn may have some insight on this.

Okay, I think I fully understand now. Depending on which line and datapoint they click on, you want to pull the URL from change_link.

You need to set a variable (url) based on what they click on to extract the change_link. Then use this variable in the link_target.

I'm not exactly sure how to set the variable, so you'll have to do some reading, but you can pull the url from a nested json via the spath command. You need to figure out how to set a token based on what they clicked on using spath to extract the change_link. Then you use that token as your link_target.

Here are some resources: spath - see nested array, spath with eval, predefined chart tokens, conditional linking, conditional matching.

<drilldown>
  <set token="url">| eval url=spath(_raw, "Analyze.$click.value${}.change_link")</set>
    <link target="_blank">$url$</link>
 </drilldown>
0 Karma

isplunk2999
Path Finder

@niketnilay - Do you have any inputs on how to set a token based on what the user clicked on using spath to extract the change_link.

0 Karma

isplunk2999
Path Finder

Forgot to add my code,following is my code

  <dashboard>
      <label>radar_trend_test_report</label>
      <row>
        <panel>
          <chart>
            <search>
              <query>index=wifiengg_cat2  sourcetype=radar_statistics_data6 | chart values(Analyze.Investigate.count) as Investigate values(Analyze.Review.count) as Review values(Analyze.Screen.count) as Screen over _time</query>
              <earliest>@w0</earliest>
              <latest>now</latest>
              <sampleRatio>1</sampleRatio>
            </search>
            <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
            <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.visibility">visible</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.axisX.abbreviation">none</option>
            <option name="charting.axisX.scale">linear</option>
            <option name="charting.axisY.abbreviation">none</option>
            <option name="charting.axisY.scale">linear</option>
            <option name="charting.axisY2.abbreviation">none</option>
            <option name="charting.axisY2.enabled">0</option>
            <option name="charting.axisY2.scale">inherit</option>
            <option name="charting.chart">line</option>
            <option name="charting.chart.bubbleMaximumSize">50</option>
            <option name="charting.chart.bubbleMinimumSize">10</option>
            <option name="charting.chart.bubbleSizeBy">area</option>
            <option name="charting.chart.nullValueMode">gaps</option>
            <option name="charting.chart.showDataLabels">none</option>
            <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
            <option name="charting.chart.stackMode">default</option>
            <option name="charting.chart.style">shiny</option>
            <option name="charting.drilldown">none</option>
            <option name="charting.layout.splitSeries">0</option>
            <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
            <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
            <option name="charting.legend.mode">standard</option>
            <option name="charting.legend.placement">right</option>
            <option name="charting.lineWidth">2</option>
            <option name="trellis.enabled">0</option>
            <option name="trellis.scales.shared">1</option>
            <option name="trellis.size">medium</option>
          </chart>
        </panel>
      </row>
    </dashboard>
0 Karma

DEAD_BEEF
Builder

What URL are you trying to redirect to? Something else in Splunk or an external url? Does it need to open in a new page or use the existing page?

0 Karma

isplunk2999
Path Finder

@DEAD_BEEF - Its an external url like "rdar://problem/123456", clicking on that will pop up a new window related to that URL

0 Karma

DEAD_BEEF
Builder

@isplunk2999 If you made the changes I suggested, then when you click on any of the lines in your graph, it will automatically open a new browser window and navigate to the link you specified.

0 Karma

isplunk2999
Path Finder

Hey @DEAD-BEEF:

The URL is different for each of the circle markers and should be fetched dynamically(its not a static link)

For example in my query below, for value "Analyze.Investigate.count" the corresponding link value is "Analyze.Investigate.link" and so forth

Analyze.Review.count --> Analyze.Review.link
Analyze.Screen.count --> Analyze.Review.link

QUERY:
index=wifiengg_cat2 sourcetype=radar_statistics_data6 | chart values(Analyze.Investigate.count) as Investigate values(Analyze.Review.count) as Review values(Analyze.Screen.count) as Screen over _time

How do I put the corresponding link for the corresponding circle marker?

0 Karma

DEAD_BEEF
Builder

Okay, I understand. Once you have the visualization done, what are the names of your series? What does the legend say? Is it Investigate, Review, and Screen? I only see 3 names in your search but 4 lines in your screenshot. You can upload an image directly to splunk answers (no need for external site).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...