- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to achieve event drill down from bar chart?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to achieve event drill down from bar chart?
I have created a search based on dynamic inputs which then get put into a visualization bar chart. I am attempting to use a drilldown token to click on the bar chart and then a panel will appear showing log events for that particular day. Below is code I am using but cannot get the events to show up:
<form version="1.1">
<label>Dynamic Splunk Dashboard MSAPIGW</label>
<fieldset submitButton="false">
<input type="radio" token="indexName">
<label>Index</label>
<choice value="master_application_non-prod">NonProd</choice>
<choice value="master_application_prod">Prod</choice>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="clusterName" searchWhenChanged="true">
<label>Cluster</label>
<fieldForLabel>cluster_name</fieldForLabel>
<fieldForValue>cluster_name</fieldForValue>
<search>
<query>index=$indexName$ cluster_name=* | dedup cluster_name | table cluster_name | sort cluster_name</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="*">All</choice>
<default>*</default>
</input>
<input type="dropdown" token="mySourceType" searchWhenChanged="true">
<label>SourceType</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=$indexName$ cluster_name=$clusterName$ sourcetype=* | dedup sourcetype | table sourcetype | sort sourcetype</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="labelApp" searchWhenChanged="true">
<label>Application</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>label_app</fieldForLabel>
<fieldForValue>label_app</fieldForValue>
<search>
<query>index=$indexName$ cluster_name=$clusterName$ sourcetype=$mySourceType$ label_app=* | dedup label_app | table label_app | sort label_app</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="text" token="errorSearch">
<label>ErrorSearch</label>
</input>
<input type="time" token="searchTime">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=$indexName$ cluster_name=$clusterName$ sourcetype=$mySourceType$ label_app=$labelApp$ $errorSearch$
| stats count as hourcount by hour
| bin hour as day span=1d
| eval day=strftime(day, "%Y-%m-%d %a")
| eval hour=strftime(hour, "%H:%M")
| chart sum(hourcount) as count by day hour</query>
<earliest>$searchTime.earliest$</earliest>
<latest>$searchTime.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<drilldown>
<eval token="drilldown_attribute">$click.value$</eval>
</drilldown>
</chart>
</panel>
</row>
<row depends="$drilldown_attribute$">
<panel>
<event>
<search>
<query>index=$indexName$ cluster_name=$clusterName$ sourcetype=$mySourceType$ label_app=$labelApp$ $errorSearch$</query>
<earliest>$searchTime.earliest$</earliest>
<latest>$searchTime.latest$</latest>
</search>
<option name="list.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row>
<row>
<panel>
<title>THESE ARE MY TOKEN VALUES</title>
<html>
<h2>Index = $indexName$</h2>
<h2>Cluster = $clusterName$</h2>
<h2>SourceType = $mySourceType$</h2>
<h2>Application = $labelApp$</h2>
<h2>ErrorSearch = $errorSearch$</h2>
<h2>Time = $searchTime$</h2>
<h2>drilldown_attribute = $click.value$</h2>
</html>
</panel>
</row>
</form>
I have gone through numerous Splunk documents and other various websites looking for solution but have yet to be able to get anything to work. Any help is appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @dickersons,
with the click.value token, you have to pass an epochtime, so try a different search:
index=$indexName$ cluster_name=$clusterName$ sourcetype=$mySourceType$ label_app=$labelApp$ $errorSearch$
| timechart span=1h count as hourcountin this way, clicking on the bar you pass the epochtime (x axys) to the drilldown.
Ciao.
Giuseppe
P.S.: next time put code in the Code Sample window
Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
