Splunk Search

How to capture Y-axis value for drill down in column chart?

viswanathsd
Path Finder

fieldname="$row.$" with and without quotes both are not working.
Fields values were renamed .Tried with both the values still didn't capturing the value.

Tags (2)
0 Karma
1 Solution

jayannah
Builder

chart (event tokens):
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The clicked field name is the name of the field or series for the y-Axis if present (similar to click.name2). If the name of the field or series is not available the field or category for the x-axis is used (click.name).

Data Property Description
click.name Name of the field or category for the x-axis. Not available when the legend has been clicked.
click.value Value of the field or category for the x-axis. Not available when the legend has been clicked.
click.name2 Name of the field or series for the y-axis.
click.value2 Value of the field or series for the y-axis. Not available when the legend has been clicked.
row. Any field values along the y-axis at the same point as the click on the x-axis. Not available when the legend has been clicked.
row. Value of the x-axis. Not available when the legend has been clicked.
earliest/latest Time range of the clicked chart segment, or if not applicable, the time range of the search.

For more details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/PanelreferenceforSimplifiedXML

View solution in original post

jayannah
Builder

chart (event tokens):
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The clicked field name is the name of the field or series for the y-Axis if present (similar to click.name2). If the name of the field or series is not available the field or category for the x-axis is used (click.name).

Data Property Description
click.name Name of the field or category for the x-axis. Not available when the legend has been clicked.
click.value Value of the field or category for the x-axis. Not available when the legend has been clicked.
click.name2 Name of the field or series for the y-axis.
click.value2 Value of the field or series for the y-axis. Not available when the legend has been clicked.
row. Any field values along the y-axis at the same point as the click on the x-axis. Not available when the legend has been clicked.
row. Value of the x-axis. Not available when the legend has been clicked.
earliest/latest Time range of the clicked chart segment, or if not applicable, the time range of the search.

For more details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/PanelreferenceforSimplifiedXML

helenashton
Path Finder

I think all you are missing is putting the column heading in, i.e. $row.host$ (or whatever).

If it isn't this, then are you using simple or advanced XML? Can you share the appropriate part of the XML?

0 Karma

viswanathsd
Path Finder

No,it will populate and used for x axis values,it worked fine.

0 Karma

viswanathsd
Path Finder

abc_xxx_summary.transaction_name field value is not caturing when I clicked

    <link>
      <![CDATA[

            /app/on_b/search?q=search%20index%3Donb%20sourcetype%3Depfapp%20OnB-*%20abc_xxx_summary.transaction_name%3D"$row.abc_xxx_summary.transaction_name$"%20%7Cbucket%20span%3D1m%20_time%7Cchart%20count%20as%20Errors%20OVER%20_time&earliest=&latest=&display.general.type=statistics
                                ]]>
    </link>      
 </drilldown>
0 Karma

helenashton
Path Finder

Am I right in assuming when you click on the link you see "$row.abc_xxx_summary.transaction_name$" in the actual link opened?
If so, I think the problem is that you are using CDATA and that the tokens might not be populated inside this. Can you check?

0 Karma

viswanathsd
Path Finder

Thanks for the response.
It was typo,I used $row.fieldname$ and using simple xml.

0 Karma

helenashton
Path Finder

So can you share the XML - it should help us work out the problem?

0 Karma
Get Updates on the Splunk Community!

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...