topic Re: help on a timechart drilldown without by clause in Splunk Search

Help with timechart drilldown without by clause

jip31 — Mon, 09 May 2022 17:20:48 GMT

hello

I timechart events without a by clause

| timechart count(crash) as "crash" count(hang) as "hang"

When I click on "cras" or "hang" I need to open a drilldown not in another dashboard but with ajust in a new window

I trie with a token or with a link to the search but it doesnt works

Could you help please?

Re: help on a timechart drilldown without by clause

ITWhisperer — Mon, 09 May 2022 15:22:46 GMT

What do you mean by "not in another dashboard"?

What do you mean by a "new window"?

What have you tried?

Re: help on a timechart drilldown without by clause

jip31 — Mon, 09 May 2022 15:27:46 GMT

it means that I dont want to create a new dash just for this drilldown

I want to use a token or a personalized link to the search

I tried this :

$click.value$=crash OR $click.value$=hang

Re: help on a timechart drilldown without by clause

ITWhisperer — Mon, 09 May 2022 16:13:13 GMT

Try

$click.name2$="crash"

$click.name2$="hang"

Re: help on a timechart drilldown without by clause

jip31 — Tue, 10 May 2022 05:15:12 GMT

it doesnt works

Re: help on a timechart drilldown without by clause

ITWhisperer — Tue, 10 May 2022 05:44:18 GMT

Please share your code so we might be able to see what is wrong - just saying "It doesnt work" doesn't help us help you!

Re: help on a timechart drilldown without by clause

jip31 — Tue, 10 May 2022 05:56:08 GMT

`index` sourcetype=tutu $click.name2$='crash_process' OR $click.name2$='hang_process' | timechart count(crash_process) as "Crash" count(hang_process) as "Hang"

Re: help on a timechart drilldown without by clause

ITWhisperer — Tue, 10 May 2022 05:55:21 GMT

$click.name2$ and other $click.xxx$ tokens are available in the drilldown not the search.

Where is your drilldown SimpleXML code?

Re: help on a timechart drilldown without by clause

jip31 — Tue, 10 May 2022 05:59:08 GMT

<drilldown> <link target="_blank">search?q=%60index%60%20source%3Dstandalone%20sourcetype%3Dez%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20search%20$click.name$%3D'Crash'&earliest=$periode.earliest$&latest=$periode.latest$</link> </drilldown>

Re: help on a timechart drilldown without by clause

ITWhisperer — Tue, 10 May 2022 06:10:28 GMT

Try it like this

<drilldown> <link target="_blank">search?q=%60index%60%20source%3Dstandalone%20sourcetype%3Dez%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20search%20$click.name2$&earliest=$periode.earliest$&latest=$periode.latest$</link> </drilldown>

Re: help on a timechart drilldown without by clause

jip31 — Tue, 10 May 2022 06:34:53 GMT

always no results

here is the updated xml

<drilldown> <link target="_blank">search?q=%60index_mesurescontinues%60%20(sourcetype%3Dezoptima%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang)%20source%3Dstandalone%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20search%20$click.name2$&earliest=$periode.earliest$&latest=$periode.latest$</link> </drilldown>

Re: help on a timechart drilldown without by clause

ITWhisperer — Tue, 10 May 2022 06:43:53 GMT

OK I am guessing you want to search for the value that was clicked?

<drilldown> <link target="_blank">search?q=%60index_mesurescontinues%60%20(sourcetype%3Dezoptima%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang)%20source%3Dstandalone%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20search%20$click.value2$&earliest=$periode.earliest$&latest=$periode.latest$</link> </drilldown>

Re: help on a timechart drilldown without by clause

jip31 — Tue, 10 May 2022 06:49:12 GMT

exactly

Re: help on a timechart drilldown without by clause

ITWhisperer — Tue, 10 May 2022 07:01:02 GMT

The previous search would have just searched for the value clicked after the drilldown search has executed. This value would have come from the search used for the panel, which doesn't necessarily have to be the same.

If it is still not giving you want you want, for a complete picture (which is always helpful), can you share both the panel search and the drilldown search?

Re: help on a timechart drilldown without by clause

jip31 — Tue, 10 May 2022 07:26:30 GMT

sorry but i dont understand everything

here is my timechart

what I need is :

1) to display the detail of crash and the detail of hang after clicking on crash bar chart or hang bar chart

2) to display both crash and hang after clicking on time serie, for example, if I click on 14:00 time serie, I want to display crash and hang corresponding to this time serie

For the moment the drilldown search is the same than the panel search because I just try to pass the token from the panel search (it means that if I click on crash, I just display crash in the drilldown timechart and if I click on hang I just display hang on the timechart)

Re: help on a timechart drilldown without by clause

ITWhisperer — Tue, 10 May 2022 08:32:46 GMT

Try something like this

<drilldown> <condition match="isnotnull($click.value$)"> <eval token="periodend">$click.value$+600</eval> <link target="_blank">search?q=%60index_mesurescontinues%60%20(sourcetype%3Dezoptima%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang)%20source%3Dstandalone%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22&earliest=$click.value$&latest=$periodend$</link> </condition> <condition> <link target="_blank">search?q=%60index_mesurescontinues%60%20(sourcetype%3Dezoptima%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang)%20source%3Dstandalone%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20fields%20_time%20$click.name2$&earliest=$periode.earliest$&latest=$periode.latest$</link> </condition> </drilldown>

Re: help on a timechart drilldown without by clause

jip31 — Tue, 10 May 2022 08:41:54 GMT

it works for the serie below (both hang and crash)

but not for this one

Re: help on a timechart drilldown without by clause

ITWhisperer — Tue, 10 May 2022 08:46:11 GMT

Sorry, I should have said, to get a chart for a single series, click on the legend; for a time period, click on either bar in the time period

Re: help on a timechart drilldown without by clause

jip31 — Tue, 10 May 2022 08:56:42 GMT

ok thanks