All Apps and Add-ons

timechart drilldown

disha
Contributor

In my search

MYSearch|chart avg(mu) over _time by vmsid

Now I want to pass vmsid value to my next view. I have tried using sideview Redirector module and splunk ViewRedirector module but it is passing time value not vmsid.


DetailedCustomerView
$click.value$
it is not working. Please help.

Thanks,
Disha

1 Solution

sideview
SplunkTrust
SplunkTrust

For timecharts that are split by another field -- in this case by vmsid, to reference the selected value of the "by field" you should use $click.name2$.

It's confusing to remember which keys to use with the charts, but they work in a very analogous way to the table drilldowns. So you can picture a SimpleResultsTable or a Table module being right where the chart module is. Then with the table modules you know that $click.value$ will always be the first column's value, and with a timechart the first column's value is always "_time". So in this way you can sort of explain why your config as written is always passing the time. 😃

In many other situations there are $foo$ keys added by Sideview Utils to make things easier or more intuitive, but in the case of grabbing the selected split-by field value from a chart or table, I'm afraid $click.name2$ is still the only way. Granted, if you were interested in vmsid="selected_vmsid_value", you could use $click.searchTerms$.

Also, as one final note beware that field names are always case sensitive and that goes here too. So VMSID is not equivalent to vmsid.

View solution in original post

sideview
SplunkTrust
SplunkTrust

For timecharts that are split by another field -- in this case by vmsid, to reference the selected value of the "by field" you should use $click.name2$.

It's confusing to remember which keys to use with the charts, but they work in a very analogous way to the table drilldowns. So you can picture a SimpleResultsTable or a Table module being right where the chart module is. Then with the table modules you know that $click.value$ will always be the first column's value, and with a timechart the first column's value is always "_time". So in this way you can sort of explain why your config as written is always passing the time. 😃

In many other situations there are $foo$ keys added by Sideview Utils to make things easier or more intuitive, but in the case of grabbing the selected split-by field value from a chart or table, I'm afraid $click.name2$ is still the only way. Granted, if you were interested in vmsid="selected_vmsid_value", you could use $click.searchTerms$.

Also, as one final note beware that field names are always case sensitive and that goes here too. So VMSID is not equivalent to vmsid.

View solution in original post

disha
Contributor

ThankYou very much.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.