All Apps and Add-ons

How to set up a drilldown from clicking on a timechart in one dashboard panel to populate a column chart in another panel?

Explorer

Hello, I have developed a relatively simple dashboard that measures the sentiment of RSS feeds that are indexed into my Splunk web version. Currently I am not able to get my Drilldown capability to work. I want the dashboard panels to work as follows: initial panel displays overall sentiment of all articles in a timechart that has drilldown capability. If someone wishes to see each individual event from a specific moment in time (they may be curious as to why sentiment is unusually high or low) they click on that moment in time, then the chart below populates a column chart that displays the sentiment of each article in that moment of time (y-axis would be sentiment and x axis would be article titles). My first panel works perfectly but my second column chart panel doesn't seem to respond to clicking on a column in the first. I have drilldown capability enabled. Here is my source code:

  <chart>
    <title>Sentiment Over Time</title>
    <searchString>index = rss_2  | dedup link  | sentiment imdb title | timechart avg(sentiment)</searchString>
    <earliestTime>0</earliestTime>
    <latestTime>now</latestTime>
    <drilldown>
      <set token="clicked_earliest">$earliest$</set>
      <set token="clicked_latest">$latest$</set>
    </drilldown>
 </chart>


  <chart>
    <title>Individual Article Sentiment</title>
    <searchString>index = rss_2  | dedup link  | sentiment imdb title | stats avg(sentiment)</searchString>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
  </chart

Any help would be greatly appreciated

0 Karma
1 Solution

Explorer

This has been solved. In my second panel I changed the search string to:
index = rss2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click
earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.

View solution in original post

Explorer

This has been solved. In my second panel I changed the search string to:
index = rss2 | dedup link | sentiment imdb title | stats avg(sentiment) by title
and used the tokens $click
earliest$ and $clicked_latest$ and the second panel displayed what I wanted it to display and changes when I want it to.

View solution in original post

Splunk Employee
Splunk Employee

I think you want to use the tokens that you created in the drilldown set elements: "clickedearliest" and "clickedlatest"

So the second chart would look like:

<chart>               
     <searchString>index = rss_2  | dedup link  | sentiment imdb title | stats avg(sentiment)</searchString>
     <earliestTime>$clicked_earliest$</earliestTime>
     <latestTime>$clicked_latest$</latestTime>
</chart>
0 Karma

Explorer

Okay, progress made. When I click on the initial dashboard now i get "Error in 'stats' command: The argument '1416373200' is invalid." any clue here? I think it may be trying to take the sentiment of the 1st dashboard's sentiment values instead of the titles and that is screwing things up.

0 Karma