All Apps and Add-ons

Timeline - Custom Visualization: How to set up tokens and control the drilldown behavior for cells, rows, and the legend?

snoobzilla
Builder

Getting some great use out of this visualization. Trying to figure out options/tokens and to control drilldown...

How can get row label as token value when I click on row label?
How can get legend as token value when I click on legend?
How do turn on/off drilldown for cell/row/legend?

Do you have any additional documentation?

What I have figured out so far...

click.name and click.name2 appear to be _time
row.field works from data points only on first field in results only so far

e.g. where end of search is this

| table _time inc_number TYPE
This works
        <drilldown target="_blank">
          <link>https://mylink&amp;sysparm_mi=$row.inc_number$</link>
        </drilldown>
This doesn't pick up TYPE
        <drilldown target="_blank">
          <link>https://mylink&amp;sysparm_mi=$row.TYPE$</link>
        </drilldown>

Thanks in advance for assistance.

Ian

davpx
Communicator
0 Karma

snoobzilla
Builder

Thanks, I had checked that but not mentions above...
click.name and click.name2 both give literal "_time"
click.value and click.value2 both give epoch time

0 Karma

davpx
Communicator

That doesn't sound correct. With the search logic provided, here's how I've seen the tokens come out testing on my side.

click.name = "_time" (leftmost column name)
click.name2 = {{column label of the cell clicked}}
click.value = {{numeric (epoch) value of _time column}}
click.value2 = {{value of cell clicked}}
row._time = {{human readable _time of row clicked}}
row.inc_number = {{value of inc_number for row clicked}}
row.TYPE = {{value of TYPE for row clicked}}

0 Karma

snoobzilla
Builder

I was asking specifically about the Timeline - Custom Visualization. Are you testing from that visualization?

https://splunkbase.splunk.com/app/3120/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...