All Apps and Add-ons

How to set up a drilldown from clicking on a timechart in one dashboard panel to populate a column chart in another panel?

tydyg
Explorer

Hello, I have developed a relatively simple dashboard that measures the sentiment of RSS feeds that are indexed into my Splunk web version. Currently I am not able to get my Drilldown capability to work. I want the dashboard panels to work as follows: initial panel displays overall sentiment of all articles in a timechart that has drilldown capability. If someone wishes to see each individual event from a specific moment in time (they may be curious as to why sentiment is unusually high or low) they click on that moment in time, then the chart below populates a column chart that displays the sentiment of each article in that moment of time (y-axis would be sentiment and x axis would be article titles). My first panel works perfectly but my second column chart panel doesn't seem to respond to clicking on a column in the first. I have drilldown capability enabled. Here is my source code:

  <chart>
    <title>Sentiment Over Time</title>
    <searchString>index = rss_2  | dedup link  | sentiment imdb title | timechart avg(sentiment)</searchString>
    <earliestTime>0</earliestTime>
    <latestTime>now</latestTime>
    <drilldown>
      <set token="clicked_earliest">$earliest$</set>
      <set token="clicked_latest">$latest$</set>
    </drilldown>
 </chart>


  <chart>
    <title>Individual Article Sentiment</title>
    <searchString>index = rss_2  | dedup link  | sentiment imdb title | stats avg(sentiment)</searchString>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
  </chart

Any help would be greatly appreciated

0 Karma
1 Solution

tydyg
Explorer

This has been solved. In my second panel I changed the search string to:
index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click_earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.

View solution in original post

tydyg
Explorer

This has been solved. In my second panel I changed the search string to:
index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click_earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.

melting
Splunk Employee
Splunk Employee

I think you want to use the tokens that you created in the drilldown set elements: "clicked_earliest" and "clicked_latest"

So the second chart would look like:

<chart>               
     <searchString>index = rss_2  | dedup link  | sentiment imdb title | stats avg(sentiment)</searchString>
     <earliestTime>$clicked_earliest$</earliestTime>
     <latestTime>$clicked_latest$</latestTime>
</chart>
0 Karma

tydyg
Explorer

Okay, progress made. When I click on the initial dashboard now i get "Error in 'stats' command: The argument '1416373200' is invalid." any clue here? I think it may be trying to take the sentiment of the 1st dashboard's sentiment values instead of the titles and that is screwing things up.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...