Dashboards & Visualizations

Drilldown for line chart

karthi25
Path Finder

I have a multi-line chart with marker enabled. When I click on the marker, it should pass the startDate value to the drilldown . Then the drilldown query will be based on that start date like below: (dateFromMarker is the date Passed)

**** startDate=$dateFromMarker$ | eval runDate = strftime(strptime($startDate$, "%Y-%m-%d"),"%Y-%m-%d")|rename wfName as WORKFLOW_NAME,comments as COMMENTS| table WORKFLOW_NAME,COMMENTS

Chart Code is as follows:

<chart>
        <search>
          <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
         | appendcols 
     [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
 | filldown FAILED_WORKFLOW_COUNT</query>
          <earliest>$time_err.earliest$</earliest>
          <latest>$time_err.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.text">Failed  Count</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
        <option name="charting.chart.showMarkers">true</option>
        <option name="charting.chart.markerSize">3</option>
      </chart>

Can Anyone please suggest me to do it.

0 Karma
1 Solution

493669
Super Champion

Hi @karthi25,
Try below:

<chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
          <option name="charting.drilldown">all</option>
           <drilldown>
                    <set token="FAILED_WORKFLOW_COUNT ">$click.value$</set>
          </drilldown>
       </chart>



  <table>
        <title>Table  for $FAILED_WORKFLOW_COUNT $</title>
        <search>
          <query>
            <your search query>
          </query>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>

View solution in original post

mayurr98
Super Champion

try this

<form>
  <label>test5</label>
  <fieldset submitButton="false">
    <input type="time" token="time_err">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">none</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
         <drilldown>
           <set token="runDate">$click.name2$</set>
           </drilldown>
       </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query> **** startDate=$runDate$ | eval runDate = strftime(strptime($startDate$, "%Y-%m-%d"),"%Y-%m-%d")|rename wfName as WORKFLOW_NAME,comments as COMMENTS| table WORKFLOW_NAME,COMMENTS</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

mayurr98
Super Champion

also tell me rundate is on x-axis or y-axis?

0 Karma

karthi25
Path Finder

@mayurr98 rundate will be at x-axis.

0 Karma

493669
Super Champion

Hi @karthi25,
Try below:

<chart>
         <search>
           <query>*** NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")  |stats count(status) as TOTAL_ERR_COUNT by runDate
          | appendcols 
      [ search ***  NOT (status='COMPLETED' OR status='INPROGRESS' OR startDate='NULL') processName='*' | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d")|dedup wfName |stats count(wfName) as FAILED_WORKFLOW_COUNT BY runDate] 
  | filldown FAILED_WORKFLOW_COUNT</query>
           <earliest>$time_err.earliest$</earliest>
           <latest>$time_err.latest$</latest>
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.text">Failed  Count</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="charting.seriesColors">[#F27281,#D5C17A]</option>
         <option name="charting.chart.showMarkers">true</option>
         <option name="charting.chart.markerSize">3</option>
          <option name="charting.drilldown">all</option>
           <drilldown>
                    <set token="FAILED_WORKFLOW_COUNT ">$click.value$</set>
          </drilldown>
       </chart>



  <table>
        <title>Table  for $FAILED_WORKFLOW_COUNT $</title>
        <search>
          <query>
            <your search query>
          </query>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>

karthi25
Path Finder

I want to pass the runDate value instead of click.value.Can you please suggest me to do it.

0 Karma

493669
Super Champion

use $click.value2$ instead of $click.value$
hope this helps you.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...