All Apps and Add-ons

How to set up a drilldown from clicking on a timechart in one dashboard panel to populate a column chart in another panel?

tydyg
Explorer

Hello, I have developed a relatively simple dashboard that measures the sentiment of RSS feeds that are indexed into my Splunk web version. Currently I am not able to get my Drilldown capability to work. I want the dashboard panels to work as follows: initial panel displays overall sentiment of all articles in a timechart that has drilldown capability. If someone wishes to see each individual event from a specific moment in time (they may be curious as to why sentiment is unusually high or low) they click on that moment in time, then the chart below populates a column chart that displays the sentiment of each article in that moment of time (y-axis would be sentiment and x axis would be article titles). My first panel works perfectly but my second column chart panel doesn't seem to respond to clicking on a column in the first. I have drilldown capability enabled. Here is my source code:

  <chart>
    <title>Sentiment Over Time</title>
    <searchString>index = rss_2  | dedup link  | sentiment imdb title | timechart avg(sentiment)</searchString>
    <earliestTime>0</earliestTime>
    <latestTime>now</latestTime>
    <drilldown>
      <set token="clicked_earliest">$earliest$</set>
      <set token="clicked_latest">$latest$</set>
    </drilldown>
 </chart>


  <chart>
    <title>Individual Article Sentiment</title>
    <searchString>index = rss_2  | dedup link  | sentiment imdb title | stats avg(sentiment)</searchString>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
  </chart

Any help would be greatly appreciated

0 Karma
1 Solution

tydyg
Explorer

This has been solved. In my second panel I changed the search string to:
index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click_earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.

View solution in original post

tydyg
Explorer

This has been solved. In my second panel I changed the search string to:
index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click_earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.

melting
Splunk Employee
Splunk Employee

I think you want to use the tokens that you created in the drilldown set elements: "clicked_earliest" and "clicked_latest"

So the second chart would look like:

<chart>               
     <searchString>index = rss_2  | dedup link  | sentiment imdb title | stats avg(sentiment)</searchString>
     <earliestTime>$clicked_earliest$</earliestTime>
     <latestTime>$clicked_latest$</latestTime>
</chart>
0 Karma

tydyg
Explorer

Okay, progress made. When I click on the initial dashboard now i get "Error in 'stats' command: The argument '1416373200' is invalid." any clue here? I think it may be trying to take the sentiment of the 1st dashboard's sentiment values instead of the titles and that is screwing things up.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...