Calendar app Drilldown options

[coreyCLI]

I have the Calendar App version 1.1.1.  We are in the process of pulling down 1.1.5 for testing.  We use the calendar to display Jira tickets for after hours call-ins.  I have not found a solution where I can get the Jira ticket to populate the URL when a user clicks on the Jira ticket displayed on the calendar.  The only values I can grab from the visualization and put into a token are _time and the epoch.  I want to be able to redirect users to Jira and the specific Jira ticket number displayed in the calendar.

[coreyCLI]

I ended up (for now) using the epoch time available in the native $value$ token in dashboard studio.  I then pass that epoch valie to a hidden table to search for the jira ticket number.  When that completes and populates another token using the search results it opens a hidden markdown box that then allows the user to click it to be redirected to Jira with the ticket number in the URL so they can go straight to that ticket.  Its a little hokey but its working for them for now until I can find an alternative.

[bowesmana]

An alternative would be to use the existing epoch value given from the calendar drilldown and open a new search showing a table of tickets matching that _time value when the ticket is clicked and then have a second layer drilldown from the table to the URL, which would be very easy.

You can make that second table small and you can make it only conditionally visible using "depends="$token$" construct in your XML.

[coreyCLI]

Using the EPOCH is something I have been testing out.

[bowesmana]

Here's a small example that creates 2 dummy tickets per day for 30 days and it shows the calendar and supports drilldown. The table below uses the search from the timechart (created as a base search) from the ticket search to just find the tickets on that clicked day. It then transposes the table and shows the tickets and drilldown can then be done on those tickets.

Hope this is useful

<dashboard version="1.1" theme="light">
  <label>calendar_test</label>
  <row>
    <panel>
      <viz type="calendar_app.calendar">
        <search id="base_calendar_data">
          <query>
| makeresults count=60
| streamstats c
| eval _time=now() - (floor(c / 2) * 86400)
| eval ticket="JIRA".(random() % 10000000 + 1000000)
| timechart span=1d limit=0 count by ticket
          </query>
          <earliest>-30d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="calendar_app.calendar.calendarView">month</option>
        <option name="calendar_app.calendar.defaultDate">last</option>
        <option name="calendar_app.calendar.showWeekNumbers">false</option>
        <option name="calendar_app.calendar.showWeekends">true</option>
        <option name="drilldown">all</option>
        <option name="height">644</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="tok_day">$click.value$</set>
          <eval token="tok_date">strftime($click.value$, "%F")</eval>
        </drilldown>
      </viz>
      <table depends="$tok_day$">
        <title>Tickets raised on $tok_date$ - select a ticket to go to the JIRA site</title>
        <search base="base_calendar_data">
          <query>
| where _time>=$tok_day$ AND _time&lt;=$tok_day$
| transpose 0 column_name=ticket
| where 'row 1'>0 AND !match(ticket, "^_")
| fields ticket
          </query>
        </search>
        <drilldown>
          <link target="_blank">https://www.google.com?q=$click.value$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

[bowesmana]

The calendar app does not support any kind of drilldown tokens other than the basic $click.*$ tokens. You'd have to modify the Javascript to be able to do that.

Depending on how your data is and the amount of data you need to show, you could look at two other apps that do support a lot of customisation, firstly the event timeline

https://splunkbase.splunk.com/app/4370

The author is an active developer. That type of view may or may not work for you.

The other is Number Set, again by a very active developer

https://splunkbase.splunk.com/app/6915

This is not specifically time based, but you can position the 'values' at fixed positions in a grid, so you could make it work, again depending on the volume of tickets you are talking about.