Dashboards & Visualizations

Drilldown for line chart

karthi25
Path Finder

I have a multi-line chart with marker enabled. When I click on the marker, it should pass the startDate value to the drilldown . Then the drilldown query will be based on that start date like below: (dateFromMarker is the date Passed)

**** startDate=$dateFromMarker$ | eval runDate = strftime(strptime($startDate$, "%Y-%m-%d"),"%Y-%m-%d")|rename wfName as WORKFLOW_NAME,comments as COMMENTS| table WORKFLOW_NAME,COMMENTS

Chart Code is as follows:

<chart>
        <search>
          <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
         | appendcols 
     [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
 | filldown FAILED_WORKFLOW_COUNT</query>
          <earliest>$time_err.earliest$</earliest>
          <latest>$time_err.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Failed  Count</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
        <option name="charting.chart.showMarkers">true</option>
        <option name="charting.chart.markerSize">3</option>
      </chart>

Can Anyone please suggest me to do it.

0 Karma
1 Solution

493669
Super Champion

Hi @karthi25,
Try below:

<chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
          <option name="charting.drilldown">all</option>
           <drilldown>
                    <set token="FAILED_WORKFLOW_COUNT ">$click.value$</set>
          </drilldown>
       </chart>



  <table>
        <title>Table  for $FAILED_WORKFLOW_COUNT $</title>
        <search>
          <query>
            <your search query>
          </query>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>

View solution in original post

mayurr98
Super Champion

try this

<form>
  <label>test5</label>
  <fieldset submitButton="false">
    <input type="time" token="time_err">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">none</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
         <drilldown>
           <set token="runDate">$click.name2$</set>
           </drilldown>
       </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query> **** startDate=$runDate$ | eval runDate = strftime(strptime($startDate$, "%Y-%m-%d"),"%Y-%m-%d")|rename wfName as WORKFLOW_NAME,comments as COMMENTS| table WORKFLOW_NAME,COMMENTS</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

mayurr98
Super Champion

also tell me rundate is on x-axis or y-axis?

0 Karma

karthi25
Path Finder

@mayurr98 rundate will be at x-axis.

0 Karma

493669
Super Champion

Hi @karthi25,
Try below:

<chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
          <option name="charting.drilldown">all</option>
           <drilldown>
                    <set token="FAILED_WORKFLOW_COUNT ">$click.value$</set>
          </drilldown>
       </chart>



  <table>
        <title>Table  for $FAILED_WORKFLOW_COUNT $</title>
        <search>
          <query>
            <your search query>
          </query>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>

karthi25
Path Finder

I want to pass the runDate value instead of click.value.Can you please suggest me to do it.

0 Karma

493669
Super Champion

use $click.value2$ instead of $click.value$
hope this helps you.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...