- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There a few questions in regards to the Interactions for Dashboard studios.
This is the current code I have:
{
"drilldown": "true",
"visualizations": {
"viz_ar3dmyq9": {
"type": "splunk.line",
"dataSources": {
"primary": "ds_jjp4wUrz"
},
"eventHandlers": [
{
"type": "drilldown.setToken",
"options": {
"tokens": [
{
"token": "click_time",
"key": "row._time.value"
}
]
}
},
{
"type": "drilldown.linkToSearch",
"options": {
"query": "SomeSearchQuery",
"earliest": "$click_time$",
"latest": "$global_time.latest$",
"type": "custom",
"newTab": true
}
}
],
"options": {
"seriesColorsByField": {},
"dataValuesDisplay": "minmax",
"y2AxisTitleText": ""
}
},
"viz_leeY0Yzv": {
"type": "splunk.markdown",
"options": {
"markdown": "**Value of Clicked row : $click_time$**",
"backgroundColor": "#ffffff",
"fontFamily": "Times New Roman",
"fontSize": "extraLarge"
}
}
},
"dataSources": {
"ds_uHpCvdwq": {
"type": "ds.search",
"options": {
"enableSmartSources": true,
"query": "someCustomQuery",
"refresh": "10s",
"refreshType": "delay"
},
"name": "CustomQuery"
},
"ds_jjp4wUrz": {
"type": "ds.search",
"options": {
"query": "AnotherCustomQuery",
"refresh": "10s",
"refreshType": "delay"
},
"name": "CustomQuery2"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-60m@m,now"
},
"title": "Global Time Range"
}
},
"layout": {
"type": "absolute",
"options": {
"width": 1440,
"height": 960,
"display": "auto"
},
"structure": [
{
"item": "viz_ar3dmyq9",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 1440,
"h": 330
}
},
{
"item": "viz_leeY0Yzv",
"type": "block",
"position": {
"x": 310,
"y": 780,
"w": 940,
"h": 30
}
}
],
"globalInputs": [
"input_global_trp"
]
},
"description": "Tracking objects",
"title": "Info"
}
The line chart maps the data from 'AnotherCustomQuery' (ds_jjp4wUrz), which is a query returning a chart that gets the max object_times for the 3 objects at one minute intervals:
Producing a 3 line chart, each line representing each object.
I can get the time the user clicked on, tokenized in "click_time", but a few puzzles remain:
1. When the user clicks on a object line, how do I get the line's object_name and pass it along to my search query?
2. For the "drilldown.linkToSearch", how can I add 1 minute to the click_time and add it into the latest?
Is it possible I don't need that range and search at a specific time?
3. When I open the dashboard, the first click search says "invalid earliest time", but subsequent clicks on the chart says it's working fine. Is there are particular reason why this is happening?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Figured out the solution:
1. I just use $name$ to get the click event object line name.
2. Put latest="+1"
3. Removed all defined tokens and put the actual values into the search.
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"enableSmartSources": true,
"query": "... where match(Object,\"$name$\") and match(Object_Time,\"$value$\")\r\n| ...",
"earliest": "$row._time.value$",
"latest": "+1m",
"type": "custom",
"newTab": true
}
}
]
The
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Figured out the solution:
1. I just use $name$ to get the click event object line name.
2. Put latest="+1"
3. Removed all defined tokens and put the actual values into the search.
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"enableSmartSources": true,
"query": "... where match(Object,\"$name$\") and match(Object_Time,\"$value$\")\r\n| ...",
"earliest": "$row._time.value$",
"latest": "+1m",
"type": "custom",
"newTab": true
}
}
]
The
