topic Re: drill down with drop down output and clicked chart value in Splunk Search

drill down with drop down output and clicked chart value

smolcj — Mon, 03 Dec 2012 05:53:09 GMT

hi all,
i have a dropdown box populating sources and a chart displaying severity of the source, as i used eval command i am not able to get a drill down from the chart. i am using simple xml
how to do this search using link option in drill down

please help me with redirect query or path to be used in link,,, how to include source variable from drop down box and click.value in option link

<form>
 <fieldset>

Select Your Source

index=main sourcetype=type |fields source

    <chart>
  <searchString>index=main source=$sources$   | chart count over severity | eval red=if(severity=="ERROR",count,0) | eval green = if(severity=="INFO",count,0)| fields - count
        </searchString>
        <drilldown>
    <link>/app/search/flashtimeline?q=source=$row.sources$|search severity</link>

Count of Tracing level
column
stacked

{"red":0xFF0000,"green":0x73A550}

        <option name="charting.legend.placement">none</option>
  <option name="charting.legend.placement">none</option>
</chart>

please help with the search query here forthe link option
please help
Thank you

Re: drill down with drop down output and clicked chart value

smolcj — Mon, 03 Dec 2012 14:01:16 GMT

Somebody please help 😞 i am stuck here ....

Re: drill down with drop down output and clicked chart value

Leo — Mon, 03 Dec 2012 20:28:09 GMT

You can add $form.< token>$ to your search query to get the value of the dropdown. In your case it would be $form.sources$

For click value there are two options: $click.value$ would return the value of X axis or the first column, $click.value2$ would return the value of Y axis or the value in the column you clicked upon.

Re: drill down with drop down output and clicked chart value

smolcj — Tue, 04 Dec 2012 04:30:29 GMT

Thanks Leo,
/app/myapp/flashtimeline?q=$form.sources$|search severity=$click.value$
worked fine, but is this possible with multi valued outputs.

Re: drill down with drop down output and clicked chart value

Leo — Tue, 04 Dec 2012 04:32:51 GMT

Would this doc be helpful? http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms#Dashboard_linking_to_a_multivalue_field

Re: drill down with drop down output and clicked chart value

smolcj — Tue, 04 Dec 2012 10:32:24 GMT

Thank you Leo