Dashboards & Visualizations

Drilldown for line chart

karthi25
Path Finder

I have a multi-line chart with marker enabled. When I click on the marker, it should pass the startDate value to the drilldown . Then the drilldown query will be based on that start date like below: (dateFromMarker is the date Passed)

**** startDate=$dateFromMarker$ | eval runDate = strftime(strptime($startDate$, "%Y-%m-%d"),"%Y-%m-%d")|rename wfName as WORKFLOW_NAME,comments as COMMENTS| table WORKFLOW_NAME,COMMENTS

Chart Code is as follows:

<chart>
        <search>
          <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
         | appendcols 
     [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
 | filldown FAILED_WORKFLOW_COUNT</query>
          <earliest>$time_err.earliest$</earliest>
          <latest>$time_err.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Failed  Count</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
        <option name="charting.chart.showMarkers">true</option>
        <option name="charting.chart.markerSize">3</option>
      </chart>

Can Anyone please suggest me to do it.

0 Karma
1 Solution

493669
Super Champion

Hi @karthi25,
Try below:

<chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
          <option name="charting.drilldown">all</option>
           <drilldown>
                    <set token="FAILED_WORKFLOW_COUNT ">$click.value$</set>
          </drilldown>
       </chart>



  <table>
        <title>Table  for $FAILED_WORKFLOW_COUNT $</title>
        <search>
          <query>
            <your search query>
          </query>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>

View solution in original post

mayurr98
Super Champion

try this

<form>
  <label>test5</label>
  <fieldset submitButton="false">
    <input type="time" token="time_err">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">none</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
         <drilldown>
           <set token="runDate">$click.name2$</set>
           </drilldown>
       </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query> **** startDate=$runDate$ | eval runDate = strftime(strptime($startDate$, "%Y-%m-%d"),"%Y-%m-%d")|rename wfName as WORKFLOW_NAME,comments as COMMENTS| table WORKFLOW_NAME,COMMENTS</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

mayurr98
Super Champion

also tell me rundate is on x-axis or y-axis?

0 Karma

karthi25
Path Finder

@mayurr98 rundate will be at x-axis.

0 Karma

493669
Super Champion

Hi @karthi25,
Try below:

<chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
          <option name="charting.drilldown">all</option>
           <drilldown>
                    <set token="FAILED_WORKFLOW_COUNT ">$click.value$</set>
          </drilldown>
       </chart>



  <table>
        <title>Table  for $FAILED_WORKFLOW_COUNT $</title>
        <search>
          <query>
            <your search query>
          </query>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>

karthi25
Path Finder

I want to pass the runDate value instead of click.value.Can you please suggest me to do it.

0 Karma

493669
Super Champion

use $click.value2$ instead of $click.value$
hope this helps you.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...