Sideview utils handling drilldown from chart legend

[MatMeredith]

I have a chart that looks like this

I'm using Sideview to configure custom drilldown options. When someone clicks on a bar in the table all is well: I can get the selected series from $click.name2$ and I can the x-axis value from $click.value$. But when someone clicks on a legend entry (e.g. the blue square on the RHS in the example above) it tries to execute the drilldown with $click.value$ not set and things go wrong. How can I special case the behaviour when $click.value$ is not set?

I've tried using the switcher module, but can't get that to match on the "not set" condition...

[sideview]

Taking a step back, things have come a long way, and in most cases you can use the $click.searchTerms$ key under a Table, SimpleResultsTable, FlashChart or JSChart drilldown.

This key will automatically have the field="Value", for both the split-by field values, and the x-axis field values, whichever are appropriate for the click in question, and the values will be properly backslash-escaped.

that said, there are still some advanced kinds of searches that can trip up this logic, and whenever it gets confused, it will stop outputting this key, so you have to be a little careful for instance if the user themselves is writing the reporting syntax... In practice though for almost any kind of report, the key will work absolutely fine. If you have a timechart or a chart or a top or something, you're gonna be fine.

Falling back from that, if you have to use the $click.value$ and $click.name2$ args to make the search yourself, the best tool is ValueSetter, with the requiredKeys param. You can use this module to only create a searchTerm based on $click.value$, if the $click.value$ key is actually set, and to omit that searchTerm when the key is not set.

There arae quite a few docs about inline chart drilldown and table drilldown. Get latest Sideview Utils (2.5), and check out "Key techniques > inline drilldown > drilldown with tables and charts". And there's another page that gives a broad overview of all $foo$ tokens in the system, and several other pages talking about drilldown features and showing table and chart drilldown examples.

I do acknowledge that the drilldown docs and $foo$ token docs have grown pretty "organically" so they are kind of all over the place and in need of some reorganization. this will happen soon. 😃

[wpreston]

I have a stacked chart very similar to this, and I use the Redirector module immediately after a JSChart in order to get the drilldown to work correctly. I specify the search and arguments needed in the "arg.q" param. For example:

<module name="Redirector">
    <param name="url">flashtimeline</param>
    <param name="popup">True</param>
    <param name="arg.q">Field_1="$click.name2$" Field_2="$Field_2.rawValue$" | stats count ... and so on</param>
    <param name="arg.earliest">$search.timeRange.earliest$</param>
    <param name="arg.latest">$search.timeRange.latest$</param>
</module> <!-- Redirector -->

I suspect you might need to use the $click.name2$ token in your search in "arg.q" to get the search to work correctly. This is just what I ended up making work, Sideview probably has better/less confusing advice.

edit:

So in the above case, the search will work to drilldown when a chart legend item is clicked, but it will not work so well when a chart section is clicked.

Another trick I use to get around this is using a ValueSetter module with the requiredKeys param downstream from the JSChart module to add a little logic to the drilldown search. I set the value of ValueSetter to "$click.name$ = $click.value$", then set both fields as requiredKeys. Then, I use the value from ValueSetter in the drilldown search params (named $mySearchKey$ in the example below). The net effect is that if the dashboard user clicks on a part of the column in the chart, $click.name$ and $click.value$ are set in the ValueSetter and then used in my drilldown search in the Redirector. If the user clicks instead on a legend item in the chart, $click.value$ is not set, so nothing is set in the ValueSetter module, and the drilldown search in the Redirector module will use a blank space where it would normally put the value from ValueSetter.

<module name="ValueSetter">
    <param name="name">mySearchKey</param>
    <param name="value">$click.name$=$click.value$</param>
    <param name = "requiredKeys">click.name,click.value</param>
    <module name="Redirector">
        <param name="url">flashtimeline</param>
        <param name="popup">True</param>
        <param name="arg.q">Field_1="$click.name2$" Field_2="$Field_2.rawValue$" $mySearchKey$ | stats count ... and so on </param>
        <param name="arg.earliest">$search.timeRange.earliest$</param>
        <param name="arg.latest">$search.timeRange.latest$</param>
    </module> <!-- Redirector -->
</module> <!-- ValueSetter -->

Again, Sideview may have better or less confusing advice but after quite a bit of trial and error, this is what worked for me.

[wpreston]

I am using rawValue in a couple of dashboards so I'll have to go and try them with the regular field names instead. Thanks for the info, sideview!

[sideview]

quick note - the rule for $.rawValue$ is that you pass rawValue in URL arguments, and the plain $foo$ key in searches. Here you're passing a search string as a URL argument, but I'm afraid search part is more important... Use the plain $Field_2$ key there so special characters get properly backslash-escaped and you don't get parse errors back from splunkd. Good use of ValueSetter btw. And check out $click.searchTerms$ ($row.searchTerms$ for the Table module of course)