Dashboards & Visualizations

Drilldown chart - How to rename $click.value2$ based on the conditions

kavyaka03
New Member

For the below query when I click on the graph, it should drill down based on the severity condition.

if $click.value2$ is CRITICAL(Ambari) then i want to rename the filed as CRITICAL
if $click.value2$ is MAJOR(Ambari) then i want to rename the filed as MAJOR
if $click.value2$ is MINOR(Ambari) then i want to rename the filed as MINOR
if $click.value2$ is CRITICAL(infra) then i want to rename the filed as CRITICAL
if $click.value2$ is MAJOR(infra) then i want to rename the filed as MAJOR
if $click.value2$ is MINOR(infra) then i want to rename the filed as MINOR

so the SEVERITY will be updated as CRITICAL or MINOR or MAJOR

DRILLDOWN QUERY:

index=alrsm sourcetype=source APPLICATION=Hadoop OR APPLICATION=Unix MANAGER_NAME=prdehdp*
SEVERITY=CRITICAL
| eval SEV=case(APPLICATION="Hadoop" AND SEVERITY="CRITICAL", "CRITICAL(Ambari)",
APPLICATION="Hadoop" AND SEVERITY="MINOR", "MINOR(Ambari)",
APPLICATION="Hadoop" AND SEVERITY="MAJOR", "MAJOR(Ambari)",
APPLICATION="Unix" AND SEVERITY="CRITICAL", "CRITICAL(Infra)",
APPLICATION="Unix" AND SEVERITY="MINOR", "MINOR(Infra)",
APPLICATION="Unix" AND SEVERITY="MAJOR", "MAJOR(Infra)")

|rename NETWORKELEMENTCODE as SERVER_NAME, AMONAME as SHORT_DESCRIPTION, SEV as SEVERITY | stats COUNT by SERVER_NAME SHORT_DESCRIPTION DESCRIPTION SEVERITY

0 Karma

aberkow
Builder

There might be a more complex answer that works too, but have you considered just splitting severity and classification into two things? Severity = MINOR, Classification = AMBARI? Then, when you click it, you don't have to worry about this.

0 Karma

kavyaka03
New Member

Can we rename the $click.value2$ based on the condition of the clicked value ?

0 Karma

vnravikumar
Champion

Hi

If possible, can you post your xml code?

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...