All Apps and Add-ons

How to set up a drilldown from clicking on a timechart in one dashboard panel to populate a column chart in another panel?

tydyg
Explorer

Hello, I have developed a relatively simple dashboard that measures the sentiment of RSS feeds that are indexed into my Splunk web version. Currently I am not able to get my Drilldown capability to work. I want the dashboard panels to work as follows: initial panel displays overall sentiment of all articles in a timechart that has drilldown capability. If someone wishes to see each individual event from a specific moment in time (they may be curious as to why sentiment is unusually high or low) they click on that moment in time, then the chart below populates a column chart that displays the sentiment of each article in that moment of time (y-axis would be sentiment and x axis would be article titles). My first panel works perfectly but my second column chart panel doesn't seem to respond to clicking on a column in the first. I have drilldown capability enabled. Here is my source code:

  <chart>
    <title>Sentiment Over Time</title>
    <searchString>index = rss_2  | dedup link  | sentiment imdb title | timechart avg(sentiment)</searchString>
    <earliestTime>0</earliestTime>
    <latestTime>now</latestTime>
    <drilldown>
      <set token="clicked_earliest">$earliest$</set>
      <set token="clicked_latest">$latest$</set>
    </drilldown>
 </chart>


  <chart>
    <title>Individual Article Sentiment</title>
    <searchString>index = rss_2  | dedup link  | sentiment imdb title | stats avg(sentiment)</searchString>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
  </chart

Any help would be greatly appreciated

0 Karma
1 Solution

tydyg
Explorer

This has been solved. In my second panel I changed the search string to:
index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click_earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.

View solution in original post

tydyg
Explorer

This has been solved. In my second panel I changed the search string to:
index = rss_2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click_earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.

melting
Splunk Employee
Splunk Employee

I think you want to use the tokens that you created in the drilldown set elements: "clicked_earliest" and "clicked_latest"

So the second chart would look like:

<chart>               
     <searchString>index = rss_2  | dedup link  | sentiment imdb title | stats avg(sentiment)</searchString>
     <earliestTime>$clicked_earliest$</earliestTime>
     <latestTime>$clicked_latest$</latestTime>
</chart>
0 Karma

tydyg
Explorer

Okay, progress made. When I click on the initial dashboard now i get "Error in 'stats' command: The argument '1416373200' is invalid." any clue here? I think it may be trying to take the sentiment of the 1st dashboard's sentiment values instead of the titles and that is screwing things up.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...