All Apps and Add-ons

Timeline - Custom Visualization: How to set up tokens and control the drilldown behavior for cells, rows, and the legend?

snoobzilla
Builder

Getting some great use out of this visualization. Trying to figure out options/tokens and to control drilldown...

How can get row label as token value when I click on row label?
How can get legend as token value when I click on legend?
How do turn on/off drilldown for cell/row/legend?

Do you have any additional documentation?

What I have figured out so far...

click.name and click.name2 appear to be _time
row.field works from data points only on first field in results only so far

e.g. where end of search is this

| table _time inc_number TYPE
This works
        <drilldown target="_blank">
          <link>https://mylink&amp;sysparm_mi=$row.inc_number$</link>
        </drilldown>
This doesn't pick up TYPE
        <drilldown target="_blank">
          <link>https://mylink&amp;sysparm_mi=$row.TYPE$</link>
        </drilldown>

Thanks in advance for assistance.

Ian

davpx
Communicator
0 Karma

snoobzilla
Builder

Thanks, I had checked that but not mentions above...
click.name and click.name2 both give literal "_time"
click.value and click.value2 both give epoch time

0 Karma

davpx
Communicator

That doesn't sound correct. With the search logic provided, here's how I've seen the tokens come out testing on my side.

click.name = "_time" (leftmost column name)
click.name2 = {{column label of the cell clicked}}
click.value = {{numeric (epoch) value of _time column}}
click.value2 = {{value of cell clicked}}
row._time = {{human readable _time of row clicked}}
row.inc_number = {{value of inc_number for row clicked}}
row.TYPE = {{value of TYPE for row clicked}}

0 Karma

snoobzilla
Builder

I was asking specifically about the Timeline - Custom Visualization. Are you testing from that visualization?

https://splunkbase.splunk.com/app/3120/

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...