Dashboards & Visualizations

Dashboard Studio - Interactions on line charts

Ho_Wai_Yung
Explorer

There a few questions in regards to the Interactions for Dashboard studios.

This is the current code I have:

{
    "drilldown": "true",
    "visualizations": {
        "viz_ar3dmyq9": {
            "type": "splunk.line",
            "dataSources": {
                "primary": "ds_jjp4wUrz"
            },
            "eventHandlers": [
                {
                    "type": "drilldown.setToken",
                    "options": {
                        "tokens": [
                            {
                                "token": "click_time",
                                "key": "row._time.value"
                            }
                        ]
                    }
                },
{
"type": "drilldown.linkToSearch",
"options": {
"query": "SomeSearchQuery",
"earliest": "$click_time$",
"latest": "$global_time.latest$",
"type": "custom",
"newTab": true
}
}
            ],
            "options": {
                "seriesColorsByField": {},
                "dataValuesDisplay": "minmax",
                "y2AxisTitleText": ""
            }
        },
        "viz_leeY0Yzv": {
            "type": "splunk.markdown",
            "options": {
                "markdown": "**Value of Clicked row : $click_time$**",
                "backgroundColor": "#ffffff",
                "fontFamily": "Times New Roman",
                "fontSize": "extraLarge"
            }
        }
    },
    "dataSources": {
        "ds_uHpCvdwq": {
            "type": "ds.search",
            "options": {
                "enableSmartSources": true,
                "query": "someCustomQuery",
                "refresh": "10s",
                "refreshType": "delay"
            },
            "name": "CustomQuery"
        },
        "ds_jjp4wUrz": {
            "type": "ds.search",
            "options": {
                "query": "AnotherCustomQuery",
                "refresh": "10s",
                "refreshType": "delay"
            },
            "name": "CustomQuery2"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type": "input.timerange",
            "options": {
                "token": "global_time",
                "defaultValue": "-60m@m,now"
            },
            "title": "Global Time Range"
        }
    },
    "layout": {
        "type": "absolute",
        "options": {
            "width": 1440,
            "height": 960,
            "display": "auto"
        },
        "structure": [
            {
                "item": "viz_ar3dmyq9",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 0,
                    "w": 1440,
                    "h": 330
                }
            },
            {
                "item": "viz_leeY0Yzv",
                "type": "block",
                "position": {
                    "x": 310,
                    "y": 780,
                    "w": 940,
                    "h": 30
                }
            }
        ],
        "globalInputs": [
            "input_global_trp"
        ]
    },
    "description": "Tracking objects",
    "title": "Info"
}

The line chart maps the data from 'AnotherCustomQuery'  (ds_jjp4wUrz), which is a query returning a chart that gets the max object_times for the 3 objects at one minute intervals:

.... | chart span=1m max(object_time) OVER _time by object


Producing a 3 line chart, each line representing each object.

I can get the time the user clicked on, tokenized in "click_time", but a few puzzles remain:
1. When the user clicks on a object line, how do I get the line's object_name and pass it along to my search query?
2. For the "drilldown.linkToSearch", how can I add 1 minute to the click_time and add it into the latest?
     Is it possible I don't need that range and search at a specific time? 
3. When I open the dashboard, the first click search says "invalid earliest time", but subsequent clicks on the chart says it's working fine. Is there are particular reason why this is happening?

Labels (4)
Tags (3)
0 Karma
1 Solution

Ho_Wai_Yung
Explorer

Figured out the solution:

1. I just use $name$ to get the click event object line name.

2. Put latest="+1"

3. Removed all defined tokens and put the actual values into the search.

 


"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"enableSmartSources": true,
"query": "... where match(Object,\"$name$\") and match(Object_Time,\"$value$\")\r\n| ...",
"earliest": "$row._time.value$",
"latest": "+1m",
"type": "custom",
"newTab": true
}
}
]

The

View solution in original post

0 Karma

Ho_Wai_Yung
Explorer

Figured out the solution:

1. I just use $name$ to get the click event object line name.

2. Put latest="+1"

3. Removed all defined tokens and put the actual values into the search.

 


"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"enableSmartSources": true,
"query": "... where match(Object,\"$name$\") and match(Object_Time,\"$value$\")\r\n| ...",
"earliest": "$row._time.value$",
"latest": "+1m",
"type": "custom",
"newTab": true
}
}
]

The

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...