topic Re: How to capture x,y data from stacked charts for drill down option in Splunk Search

How to capture x,y data from stacked charts for drill down option

GaryZ — Mon, 25 Sep 2023 22:08:49 GMT

Is there a way of capturing the x, y and z data from a stacked chart?

At the moment, my x and y are as follows

x = build info

y = duration

z = process name. (various names stacked in the same column)

Re: How to capture x,y data from stacked charts for drill down option

bowesmana — Mon, 25 Sep 2023 23:37:31 GMT

The drilldown tokens for a stacked chart will be

Value of the X-axis (where x_axis_name is the name of the field on your x-axis - i.e. build info) - both of these will work.

$click.value$ $row.x_axis_name$

Name of the X-axis column

$click.name$

Value of the clicked stacked element (duration)

$click.value2$

and name of the clicked stacked element (process name)

$click.name2$

Re: How to capture x,y data from stacked charts for drill down option

GaryZ — Tue, 26 Sep 2023 20:37:52 GMT

@bowesmana ,

I've created the tokens via Drilldown Editor. However when I try using the tokens in a panel, ie.

| stats values($value2$), values($trellis_split$), values($trellis_value$), values($row_axis_name$), values($row_fieldname$), values($d_trellis_split$), values($d_trellis_value$), values($d_trellis_name$), values($d_value1$),

I'm only seeing name1 & trellis_name. Everything else is blanked.

Re: How to capture x,y data from stacked charts for drill down option

bowesmana — Wed, 27 Sep 2023 00:23:23 GMT

If you have values that contain spaces or other punctuation characters, then you should ensure the tokens quote the values, which is normally done with

| stats values($value2|s$)...

i.e. adding |s before the final $ sign, that tells Splunk to quote the token value.

However, in the above, your values() statements are expecting FIELD NAMES, containing values, whereas the value of the $value2$ token will be the clicked duration, and so values($value2$) is meaningless.

What are you actually trying to do with that stats statement - is it just to debug things?

Sometimes when debugging token things, it's useful to just add an html panel inside the dashboard where you can render the tokens, e.g.

<row> <panel> <html> <h2>name1=$name1|s$</h2> <h2>value1=$value1|s$</h2> </html> </panel> </row>

Re: How to capture x,y data from stacked charts for drill down option

GaryZ — Wed, 04 Oct 2023 21:12:20 GMT

@bowesmana

I'm using the stats statement to help with debugging the actions I'm doing on the UI. I've tried adding a html panel to help better understand the various actions from the drill down. However I'm not seeing what I'm expecting to see.

I currently have a stacked column chart. I would like to hover or click on any of the data in the stacked chart, to get the x,y, z data. (i.e. x = build, y = duration time, and z= name of task/column-segment)

Do you happen to know how I can capture this information, when I click on a point in the stacked column?

Re: How to capture x,y data from stacked charts for drill down option

bowesmana — Wed, 04 Oct 2023 21:31:12 GMT

Please refer to my first post - these are the tokens that represent the attributes of your chart for when you click on the chart. Your stats statement will NOT show the clicked values because it's an incorrect statement.

What is your HTML panel and what are you seeing when you click values and what are you expecting to see. Please show the XML for your drilldown and HTML panel.

Re: How to capture x,y data from stacked charts for drill down option

GaryZ — Thu, 05 Oct 2023 17:16:43 GMT

@bowesmana

I've used this code to check on the values

<html> <h3>Token values</h3> <table border="0" cellpadding="12" cellspacing="0"> <tr> <td> Time range (epoch time) $$timeSelect1.earliest$$: $timeSelect1.earliest$ $$timeSelect1.latest$$: $timeSelect1.latest$ $$timeSelect1.earliest_ts$$: $timeSelect1.earliest_ts$ $$timeSelect1.latest_ts$$: $timeSelect1.latest_ts$ $$earliest$$: $earliest$ $$latest$$: $latest$ $$table_minutes_away$$: $table_minutes_away$ $$drilldownsettingtimerange$$: $drilldownsettingtimerange$ </td> <td> Filter Values $$displayUnits$$: $displayUnits$ $$filterBy$$: $filterBy$ $$removeParam$$: $removeParam$ $$rankBy$$: $rankBy$ $$filterNWCompletionCode$$: $filterNWCompletionCode$ $$filterNWPredictionCode$$: $filterNWPredictionCode$ $$useLoad$$: $useLoad$ $$showLive$$: $showLive$ </td> <td> Click Values $$job.runDuration$$: $job.runDuration$ $$whereclick$$: $whereclick$ $$clickname$$: $click.name$ $$clickvalue$$: $click.value$ $$clickname2$$: $click.name2$ $$clickvalue2$$: $click.value2$ $$clickearly$$: $clickearly$ $$clicklate$$: $clicklate$ $$row.duration$$: $row.duration$ $$rownode$$: $rownode$ </td> <td> Search Values $$radar|s$$: $radar|s$ $$form.pre_source$$: $form.pre_source$ $$form.source|s$$: $form.source|s$ $$source$$: $source$ $$form.terms|s$$: $form.terms|s$ $$terms$$: $terms$ $$subsystems|s$$: $subsystems|s$ $$categories|s$$: $categories|s$ $$hidden$$: $hidden$ $$mlModelsAvailable$$: $mlModelsAvailable$ </td> <td> Search Values $$search_results$$: $search_results$ </td> </tr> </table> </html>

This is what I see when I clicked on any parts of the stacked charts (no difference in values)

Re: How to capture x,y data from stacked charts for drill down option

bowesmana — Fri, 06 Oct 2023 00:12:43 GMT

Without seeing how you assign the tokens, it's hard to say why they are not showing anything, but you have to assign the click names and values in the <drilldown> section - these will not show any value outside that, so this will never work.

$$clickname$$: $click.name$ $$clickvalue$$: $click.value$ $$clickname2$$: $click.name2$ $$clickvalue2$$: $click.value2$

Here is a working example of a <row> that shows you how it works

<row> <panel> <chart> <search> <query>index=_audit | chart count over user by action</query> <earliest>-4h@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <drilldown> <set token="user">$row.user$</set> <set token="CV">$click.value$</set> <set token="CN">$click.name$</set> <set token="CV2">$click.value2$</set> <set token="CN2">$click.name2$</set> </drilldown> </chart> <html depends="$CV$"> <h2>CV=$CV$</h2> <h2>CN=$CN$</h2> <h2>CV2=$CV2$</h2> <h2>CN2=$CN2$</h2> <h2>User=$user$</h2> </html> </panel> </row>

Re: How to capture x,y data from stacked charts for drill down option

GaryZ — Fri, 06 Oct 2023 22:18:24 GMT

@bowesmana Thank you. Your example helped me grasp this better.