Timeline - Custom Visualization: How to set up tokens and control the drilldown behavior for cells, rows, and the legend?

[snoobzilla]

Getting some great use out of this visualization. Trying to figure out options/tokens and to control drilldown...

How can get row label as token value when I click on row label?
How can get legend as token value when I click on legend?
How do turn on/off drilldown for cell/row/legend?

Do you have any additional documentation?

What I have figured out so far...

click.name and click.name2 appear to be _time
row.field works from data points only on first field in results only so far

e.g. where end of search is this

| table _time inc_number TYPE
This works
        <drilldown target="_blank">
          <link>https://mylink&amp;sysparm_mi=$row.inc_number$</link>
        </drilldown>
This doesn't pick up TYPE
        <drilldown target="_blank">
          <link>https://mylink&amp;sysparm_mi=$row.TYPE$</link>
        </drilldown>

Thanks in advance for assistance.

Ian

[davpx]

Take a look here. You might be after click.value

http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Predefined_tokens_for_dynamic_drilldown

[snoobzilla]

Thanks, I had checked that but not mentions above...
click.name and click.name2 both give literal "_time"
click.value and click.value2 both give epoch time

[davpx]

That doesn't sound correct. With the search logic provided, here's how I've seen the tokens come out testing on my side.

click.name = "_time" (leftmost column name)
click.name2 = {{column label of the cell clicked}}
click.value = {{numeric (epoch) value of _time column}}
click.value2 = {{value of cell clicked}}
row._time = {{human readable _time of row clicked}}
row.inc_number = {{value of inc_number for row clicked}}
row.TYPE = {{value of TYPE for row clicked}}

[snoobzilla]

I was asking specifically about the Timeline - Custom Visualization. Are you testing from that visualization?

https://splunkbase.splunk.com/app/3120/