topic Re: How to click a timechart "count by" result as input to reopen the same dashboard? in Dashboards & Visualizations

How to click a timechart "count by" result as input to reopen the same dashboard?

wangkevin1029 — Tue, 17 Jan 2023 20:18:38 GMT

Hi, Splunkers,

I have a timechart in dashboard..

l timechart span=1h count by VQ,

then timechart returns a graph with VQ_A, VQ_B, VQ_C with their values.

I want to click these VQ_XXX as input to reopen the dashboard.

how to pass these "count by" result as input to my dashboard?

actually, in my timechart:
l timechart span=1h count by VQ, this VQ comes from a token.

there is a chart option below :

<option name="charting. Drilldown">$t_countby$</option>,

if I put token t_countby here, then when I click VQ_A, or, VQ_B, VQ_C in my timechart, the value passed as input is VQ， which I selected from droplist with token t_countby, not VQ_A, or, VQ_B, VQ_C, which I expected to pass as input.

thx in advance.

Kevin

Re: How to click a timechart "count by" result as input to reopen the same dashboard?

richgalloway — Tue, 17 Jan 2023 22:11:36 GMT

I believe you want $click,value2$ in the drilldown.

<option name="charting. Drilldown">$click.value2$</option>

Re: How to click a timechart "count by" result as input to reopen the same dashboard?

bowesmana — Wed, 18 Jan 2023 02:17:43 GMT

@wangkevin1029

You want to set

and then in your <drilldown> section do this

<drilldown> <set token="t_count_by">$click.name2$</set> </drilldown>

That will create a token called "t_count_by" and its value will be "VQ_aa" where aa is the value of your A, B, C example.

The $click.xxx$ tokens that are filled are

$click.name$ = the word "_time"
$click.name2$ = the NAME of the series (i.e. VQ_A/B/C)
$click.value$ = the _time value of the clicked data point
$click.value2$ = the VQ_X value of the clicked data point

See this

https://docs.splunk.com/Documentation/Splunk/9.0.3/Viz/PanelreferenceforSimplifiedXML#Drilldown_event_tokens

Re: How to click a timechart "count by" result as input to reopen the same dashboard?

wangkevin1029 — Wed, 18 Jan 2023 13:49:03 GMT

Bowesmana，

I will try it,thx.

Kevin

Re: How to click a timechart "count by" result as input to reopen the same dashboard?

wangkevin1029 — Wed, 18 Jan 2023 15:47:36 GMT

richgalloway/bowesmana,

if I put all in charting.drilldown, "<option name="charting.drilldown">all</option>" ,"then "$click.value2$" itself shows in form.Gucid_token_with2handlers, not click.value2, but string itself ""$click.value2$"" shows in new opened dashboard.

if I put $click.value2$ in charting.drilldown, """<option name="charting.drilldown">$click.value2$</option>, ,then drilldown doesn't open new target dashboard..

the following is my charting.drilldown option and drilldown code"

<option name="charting.chart.stackMode">$t_StackType$</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">$click.value2$</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">bottom</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <drilldown> <condition match="$t_DrillDown$ = "*""> <link target="_blank"> <![CDATA[ /app/optum_gvp/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token_with2handlers=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$ ]]> </link> <link target="_blank"> <![CDATA[ /app/optum_gvp/pkvp_search_based_on_session_id?form.field1=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$ ]]> </link> </condition> <condition match="$t_DrillDown$ = "PSID""> <link target="_blank"> <![CDATA[ /app/optum_gvp/pkvp_search_based_on_session_id?form.field1=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$ ]]> </link> </condition> <condition match="$t_DrillDown$ = "PW""> <link target="_blank"> <![CDATA[ /app/optum_gvp/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token_with2handlers=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$ ]]> </link> </condition> </drilldown>

Re: How to click a timechart "count by" result as input to reopen the same dashboard?

richgalloway — Wed, 18 Jan 2023 15:52:22 GMT

I gave you some misleading advice. As @bowesmana mentioned, set drilldown to "all" and use $click.value2$ in your drilldown query to pass the selected value.

Re: How to click a timechart "count by" result as input to reopen the same dashboard?

bowesmana — Thu, 19 Jan 2023 04:19:59 GMT

@wangkevin1029

Some problems - make sure you have this

anything else is wrong.

I am not sure why you are using click.value2 - I understood you want the NAME of the series, not the value at the click point. Use $click.name2$ as mentioned to get the series name.

Other issues are

Is this t_DrillDown a token you have set elsewhere in the dashboard

Otherwise, if you are clicking on the legend of the chart, then click.value2 WILL have the value $click.value2$ which is passed to the drilldown

If you really want the VALUE not the name, then when clicking on the legend, what value do you want to provide to the drilldown?

Re: How to click a timechart "count by" result as input to reopen the same dashboard?

wangkevin1029 — Thu, 19 Jan 2023 14:49:37 GMT

Hi, bowesmana,

it works, after I changed $click.value2$ to $click.name2$.

t_drilldown is a different input as a condition to open different dashboard.

Kevin