- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Event Drill Down From Bar Chart
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to achieve event drill down from bar chart?
I have created a search based on dynamic inputs which then get put into a visualization bar chart. I am attempting to use a drilldown token to click on the bar chart and then a panel will appear showing log events for that particular day. Below is code I am using but cannot get the events to show up:
<form version="1.1">
<label>Dynamic Splunk Dashboard MSAPIGW</label>
<fieldset submitButton="false">
<input type="radio" token="indexName">
<label>Index</label>
<choice value="master_application_non-prod">NonProd</choice>
<choice value="master_application_prod">Prod</choice>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="clusterName" searchWhenChanged="true">
<label>Cluster</label>
<fieldForLabel>cluster_name</fieldForLabel>
<fieldForValue>cluster_name</fieldForValue>
<search>
<query>index=$indexName$ cluster_name=* | dedup cluster_name | table cluster_name | sort cluster_name</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="*">All</choice>
<default>*</default>
</input>
<input type="dropdown" token="mySourceType" searchWhenChanged="true">
<label>SourceType</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=$indexName$ cluster_name=$clusterName$ sourcetype=* | dedup sourcetype | table sourcetype | sort sourcetype</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="labelApp" searchWhenChanged="true">
<label>Application</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>label_app</fieldForLabel>
<fieldForValue>label_app</fieldForValue>
<search>
<query>index=$indexName$ cluster_name=$clusterName$ sourcetype=$mySourceType$ label_app=* | dedup label_app | table label_app | sort label_app</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="text" token="errorSearch">
<label>ErrorSearch</label>
</input>
<input type="time" token="searchTime">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=$indexName$ cluster_name=$clusterName$ sourcetype=$mySourceType$ label_app=$labelApp$ $errorSearch$
| stats count as hourcount by hour
| bin hour as day span=1d
| eval day=strftime(day, "%Y-%m-%d %a")
| eval hour=strftime(hour, "%H:%M")
| chart sum(hourcount) as count by day hour</query>
<earliest>$searchTime.earliest$</earliest>
<latest>$searchTime.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<drilldown>
<eval token="drilldown_attribute">$click.value$</eval>
</drilldown>
</chart>
</panel>
</row>
<row depends="$drilldown_attribute$">
<panel>
<event>
<search>
<query>index=$indexName$ cluster_name=$clusterName$ sourcetype=$mySourceType$ label_app=$labelApp$ $errorSearch$</query>
<earliest>$searchTime.earliest$</earliest>
<latest>$searchTime.latest$</latest>
</search>
<option name="list.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row>
<row>
<panel>
<title>THESE ARE MY TOKEN VALUES</title>
<html>
<h2>Index = $indexName$</h2>
<h2>Cluster = $clusterName$</h2>
<h2>SourceType = $mySourceType$</h2>
<h2>Application = $labelApp$</h2>
<h2>ErrorSearch = $errorSearch$</h2>
<h2>Time = $searchTime$</h2>
<h2>drilldown_attribute = $click.value$</h2>
</html>
</panel>
</row>
</form>
I have gone through numerous Splunk documents and other various websites looking for solution but have yet to be able to get anything to work. Any help is appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @dickersons,
with the click.value token, you have to pass an epochtime, so try a different search:
index=$indexName$ cluster_name=$clusterName$ sourcetype=$mySourceType$ label_app=$labelApp$ $errorSearch$
| timechart span=1h count as hourcountin this way, clicking on the bar you pass the epochtime (x axys) to the drilldown.
Ciao.
Giuseppe
P.S.: next time put code in the Code Sample window
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
