All Apps and Add-ons

Does the new Punchcard visualization in Splunk 6.4 Punchcard support standard token setting and drilldown?

sbob909
Explorer

I've got the new custom visualization Punchcard displayed just the way I want it to, but I can't seem to set a token when I click on a circle. For example, assume I have a query such as

... | table cluster node latency color

and then I use the following drilldown in my XML

    <drilldown target="Node Explorer">
      <set token="this_node">$row.node$</set>
      <link>node_explorer?form.node_input=$this_node$</link>
    </drilldown>

What gets passed to the target page is $row.node$, which tells me that the token isn't getting set properly on the click.

Do the new custom visualization support standard token setting? The doc is minimal. So I looked around, couldn't find others having this problem.

I'd appreciate any ideas. Thanks.

0 Karma
1 Solution

sbob909
Explorer

@magnew, thanks for the reply.

I did some more research on this and what it turned out to be was this. My query, which I had edited for this post to avoid confusion with other readers, was actually more like this:

| table cluster node latency color clusterNode

Note the 5th field, clusterNode. With other classic Splunk visualizations, I often rely on a field not represented in the visualization as the source for my drilldown link.

It turns out, with the new Punchcard visualization, using fields not shown in the visualization doesn't work. So I had to rework my drilldown link (and destination views) to use a combination of the first two fields (cluster, node) as the necessary values to get where I was going.

I hope this research helps others avoid similar miscues and lost time.

View solution in original post

0 Karma

sbob909
Explorer

@magnew, thanks for the reply.

I did some more research on this and what it turned out to be was this. My query, which I had edited for this post to avoid confusion with other readers, was actually more like this:

| table cluster node latency color clusterNode

Note the 5th field, clusterNode. With other classic Splunk visualizations, I often rely on a field not represented in the visualization as the source for my drilldown link.

It turns out, with the new Punchcard visualization, using fields not shown in the visualization doesn't work. So I had to rework my drilldown link (and destination views) to use a combination of the first two fields (cluster, node) as the necessary values to get where I was going.

I hope this research helps others avoid similar miscues and lost time.

0 Karma

magnew_splunk
Splunk Employee
Splunk Employee

Hello @sbob909,

The new visualizations do support standard token setting. I've just been trying this scenario with my own searches and the tokens seem to get set correctly on redirect. There is a little bit of a caveat: in the punchcard viz, if you click on an axis label, you will get tokens set for that axis, but not the other one, and vice versa. If you click on one of the circles, you will get tokens for both axes. Where are you clicking to cause the drilldown? Does clicking the other axis or a circle get you the right tokens?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...