All Apps and Add-ons

Does the new Punchcard visualization in Splunk 6.4 Punchcard support standard token setting and drilldown?

sbob909
Explorer

I've got the new custom visualization Punchcard displayed just the way I want it to, but I can't seem to set a token when I click on a circle. For example, assume I have a query such as

... | table cluster node latency color

and then I use the following drilldown in my XML

    <drilldown target="Node Explorer">
      <set token="this_node">$row.node$</set>
      <link>node_explorer?form.node_input=$this_node$</link>
    </drilldown>

What gets passed to the target page is $row.node$, which tells me that the token isn't getting set properly on the click.

Do the new custom visualization support standard token setting? The doc is minimal. So I looked around, couldn't find others having this problem.

I'd appreciate any ideas. Thanks.

0 Karma
1 Solution

sbob909
Explorer

@magnew, thanks for the reply.

I did some more research on this and what it turned out to be was this. My query, which I had edited for this post to avoid confusion with other readers, was actually more like this:

| table cluster node latency color clusterNode

Note the 5th field, clusterNode. With other classic Splunk visualizations, I often rely on a field not represented in the visualization as the source for my drilldown link.

It turns out, with the new Punchcard visualization, using fields not shown in the visualization doesn't work. So I had to rework my drilldown link (and destination views) to use a combination of the first two fields (cluster, node) as the necessary values to get where I was going.

I hope this research helps others avoid similar miscues and lost time.

View solution in original post

0 Karma

sbob909
Explorer

@magnew, thanks for the reply.

I did some more research on this and what it turned out to be was this. My query, which I had edited for this post to avoid confusion with other readers, was actually more like this:

| table cluster node latency color clusterNode

Note the 5th field, clusterNode. With other classic Splunk visualizations, I often rely on a field not represented in the visualization as the source for my drilldown link.

It turns out, with the new Punchcard visualization, using fields not shown in the visualization doesn't work. So I had to rework my drilldown link (and destination views) to use a combination of the first two fields (cluster, node) as the necessary values to get where I was going.

I hope this research helps others avoid similar miscues and lost time.

0 Karma

magnew_splunk
Splunk Employee
Splunk Employee

Hello @sbob909,

The new visualizations do support standard token setting. I've just been trying this scenario with my own searches and the tokens seem to get set correctly on redirect. There is a little bit of a caveat: in the punchcard viz, if you click on an axis label, you will get tokens set for that axis, but not the other one, and vice versa. If you click on one of the circles, you will get tokens for both axes. Where are you clicking to cause the drilldown? Does clicking the other axis or a circle get you the right tokens?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...