Dashboards & Visualizations

Drilldown for line chart

karthi25
Path Finder

I have a multi-line chart with marker enabled. When I click on the marker, it should pass the startDate value to the drilldown . Then the drilldown query will be based on that start date like below: (dateFromMarker is the date Passed)

**** startDate=$dateFromMarker$ | eval runDate = strftime(strptime($startDate$, "%Y-%m-%d"),"%Y-%m-%d")|rename wfName as WORKFLOW_NAME,comments as COMMENTS| table WORKFLOW_NAME,COMMENTS

Chart Code is as follows:

<chart>
        <search>
          <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
         | appendcols 
     [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
 | filldown FAILED_WORKFLOW_COUNT</query>
          <earliest>$time_err.earliest$</earliest>
          <latest>$time_err.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Failed  Count</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
        <option name="charting.chart.showMarkers">true</option>
        <option name="charting.chart.markerSize">3</option>
      </chart>

Can Anyone please suggest me to do it.

0 Karma
1 Solution

493669
Super Champion

Hi @karthi25,
Try below:

<chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
          <option name="charting.drilldown">all</option>
           <drilldown>
                    <set token="FAILED_WORKFLOW_COUNT ">$click.value$</set>
          </drilldown>
       </chart>



  <table>
        <title>Table  for $FAILED_WORKFLOW_COUNT $</title>
        <search>
          <query>
            <your search query>
          </query>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>

View solution in original post

mayurr98
Super Champion

try this

<form>
  <label>test5</label>
  <fieldset submitButton="false">
    <input type="time" token="time_err">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">none</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
         <drilldown>
           <set token="runDate">$click.name2$</set>
           </drilldown>
       </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query> **** startDate=$runDate$ | eval runDate = strftime(strptime($startDate$, "%Y-%m-%d"),"%Y-%m-%d")|rename wfName as WORKFLOW_NAME,comments as COMMENTS| table WORKFLOW_NAME,COMMENTS</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

mayurr98
Super Champion

also tell me rundate is on x-axis or y-axis?

0 Karma

karthi25
Path Finder

@mayurr98 rundate will be at x-axis.

0 Karma

493669
Super Champion

Hi @karthi25,
Try below:

<chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
          <option name="charting.drilldown">all</option>
           <drilldown>
                    <set token="FAILED_WORKFLOW_COUNT ">$click.value$</set>
          </drilldown>
       </chart>



  <table>
        <title>Table  for $FAILED_WORKFLOW_COUNT $</title>
        <search>
          <query>
            <your search query>
          </query>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>

karthi25
Path Finder

I want to pass the runDate value instead of click.value.Can you please suggest me to do it.

0 Karma

493669
Super Champion

use $click.value2$ instead of $click.value$
hope this helps you.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...