timechart drilldown

[disha]

In my search

MYSearch|chart avg(mu) over _time by vmsid

Now I want to pass vmsid value to my next view. I have tried using sideview Redirector module and splunk ViewRedirector module but it is passing time value not vmsid.

Thanks,
Disha

[sideview · Accepted solution]

For timecharts that are split by another field -- in this case by vmsid, to reference the selected value of the "by field" you should use $click.name2$.

It's confusing to remember which keys to use with the charts, but they work in a very analogous way to the table drilldowns. So you can picture a SimpleResultsTable or a Table module being right where the chart module is. Then with the table modules you know that $click.value$ will always be the first column's value, and with a timechart the first column's value is always "_time". So in this way you can sort of explain why your config as written is always passing the time. 😃

In many other situations there are $foo$ keys added by Sideview Utils to make things easier or more intuitive, but in the case of grabbing the selected split-by field value from a chart or table, I'm afraid $click.name2$ is still the only way. Granted, if you were interested in vmsid="selected_vmsid_value", you could use $click.searchTerms$.

Also, as one final note beware that field names are always case sensitive and that goes here too. So VMSID is not equivalent to vmsid.

[disha]

ThankYou very much.