Dashboards & Visualizations

How do you use a custom field as a token for a drilldown?

fshimaya
Engager

I have a dashboard that contains a line chart. The query for this is something like:

search ....... | rex field=_raw " (ERROR|E|SEVERE) (?<method>[a-zA-Z0-9\. \-]*)[:\. ]" | timechart count by method limit=10 usenull=f useother=f

The custom field is "method". I would like a drill-down configured so that when the user clicks on either the data point on the chart or the label name, it will take the method value and add it to the query of the "Search" dashboard. So something as simple as:

search $method$

I have tried using $method$ but it literally adds "$method$" to the query. The reason I don't want to use "Auto" feature of the drilldown is that I don't want all the search arguments from the original query added to the drilldown (it's rather long and complicated). I just want the drilldown to have a simple query.

1 Solution

somesoni2
Revered Legend

After you timechart query, there is no field named "method" (instead you'll get a column for each value of field method). Try using $click.name2$ to capture name of the columns which is basically value of the field method.

http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...

View solution in original post

somesoni2
Revered Legend

After you timechart query, there is no field named "method" (instead you'll get a column for each value of field method). Try using $click.name2$ to capture name of the columns which is basically value of the field method.

http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...