Dashboards & Visualizations

How to create dependent drilldown for Year and Month?

elomotanpru
Path Finder

Splunk newbie here again,

Currently search for a way to create a dependent drilldown where the Year would be the basis the independent and the Month would be the dependent since the reports that would be generated would need to look back from the previous, current, and possibly future reports.

My temporary fix is using the Input Panel to pass it like in a string format. However the team I am  creating this for was searching for a way to avoid the users from typing in the input.

Attaching a screenshot of the code along with the code at the moment.

elomotanpru_1-1653430364005.png

 

 

<form theme="dark">
  <label>CSC/ERSC/PSI PAGING Report</label>
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="lpar">
      <label>Select to View</label>
      <choice value="----">----</choice>
      <choice value="D7X0">D7X0</choice>
      <choice value="H7X0">H7X0</choice>
      <choice value="D1D0">D1D0</choice>
      <choice value="DAD0">DAD0</choice>
      <choice value="E1D0">E1D0</choice>
      <choice value="H1D0">H1D0</choice>
      <choice value="WSYS">WSYS</choice>
      <choice value="YSYS">YSYS</choice>
      <default>----</default>
    </input>
    <input type="dropdown" token="&quot;y&quot;">
      <label>Select Year</label>
      <choice value="2022">2022</choice>
      <default>2022</default>
    </input>
    <input type="dropdown" token="month">
      <label>Select Month</label>
      <choice value="earliest=@y latest=@y+1mon">January</choice>
      <choice value="earliest=@y+1mon latest=@y+2mon">February</choice>
      <choice value="earliest=@y+2mon latest=@y+3mon">March</choice>
      <choice value="earliest=@y+3mon latest=@y+4mon">April</choice>
      <choice value="earliest=@y+4mon latest=@y+5mon">May</choice>
      <choice value="earliest=@y+5mon latest=@y+6mon">June</choice>
      <choice value="earliest=@y+6mon latest=@y+7mon">July</choice>
      <choice value="earliest=@y+7mon latest=@y+8mon">August</choice>
      <choice value="earliest=@y+8mon latest=@y+9mon">September</choice>
      <choice value="earliest=@y+9mon latest=@y+10mon">Ocotber</choice>
      <choice value="earliest=@y+10mon latest=@y+11mon">November</choice>
      <choice value="earliest=@y+11mon latest=@y+12mon">December</choice>
    </input>
    <input type="text" token="from">
      <label>From MM/DD/YYYY</label>
      <default>01/01/2022</default>
    </input>
    <input type="text" token="to">
      <label>To MM/DD/YYYY</label>
      <default>01/31/2022</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$lpar$ Date Panel</title>
      <chart>
        <title>From &amp; To Input: $from$ - $to$</title>
        <search>
          <query>index=mainframe-platform sourcetype="mainframe:mpage" 
MVS_SYSTEM_ID=$lpar$
| eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d")
| eval _time=strptime(DATE." ","%Y-%m-%d")
| where _time &gt;= strptime("$from$", "%m/%d/%Y") AND _time &lt;= strptime("$to$", "%m/%d/%Y")
| eval epochtime=strptime(TIME, "%H:%M:%S")| eval desired_time=strftime(epochtime, "%H:%M:%S")
| chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over _time</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.text">Date of Occurrence</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="height">789</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">/app/mainframe-platform/csierscpsi_paging_individual_report?_time=$click.name2$</link>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Select a Month using $month$</title>
        <search>
          <query>index=mainframe-platform sourcetype="mainframe:mpage" 
MVS_SYSTEM_ID=$lpar$
| eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d")
| eval _time=strptime(DATE." ","%Y-%m-%d")
| where $month$
| chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over _time</query>
          <earliest>$range.earliest$</earliest>
          <latest>$range.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="height">789</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

 

Labels (5)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hide the inputs

    <input type="text" token="from" depends="$neverset$">
      <label>From MM/DD/YYYY</label>
      <default>01/01/2022</default>
    </input>
    <input type="text" token="to" depends="$neverset$">
      <label>To MM/DD/YYYY</label>
      <default>01/31/2022</default>
    </input>

elomotanpru
Path Finder

I was able to create almost something similar but it causes "Search is waiting for input" notification.

Might just start another thread for this but below is my XML code.

<form theme="dark">
  <label>CSC/ERSC/PSI PAGING Report</label>
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="lpar">
      <label>Select to View</label>
      <choice value="----">----</choice>
      <choice value="D7X0">D7X0</choice>
      <choice value="H7X0">H7X0</choice>
      <choice value="D1D0">D1D0</choice>
      <choice value="DAD0">DAD0</choice>
      <choice value="E1D0">E1D0</choice>
      <choice value="H1D0">H1D0</choice>
      <choice value="WSYS">WSYS</choice>
      <choice value="YSYS">YSYS</choice>
      <default>----</default>
    </input>
    <input type="dropdown" token="year">
      <label>Select Year</label>
      <choice value="----">----</choice>
      <choice value="2022">2022</choice>
      <default>----</default>
    </input>
    <input type="dropdown" token="month1">
      <label>Select Month</label>
      <choice value="****">****</choice>
      <choice value="01/01/">January</choice>
      <choice value="02/01/">February</choice>
      <choice value="03/01/">March</choice>
      <choice value="04/01/">April</choice>
      <choice value="05/01/">May</choice>
      <choice value="06/01/">June</choice>
      <choice value="07/01/">July</choice>
      <choice value="08/01/">August</choice>
      <choice value="09/01/">September</choice>
      <choice value="10/01/">Ocotber</choice>
      <choice value="11/01/">November</choice>
      <choice value="12/01/">December</choice>
      <default>****</default>
      <change>
        <condition label="****">
          <set token="month2">----</set>
        </condition>
        <condition label="January">
          <set token="month2">01/31/</set>
        </condition>
        <condition label="February">
          <set token="month2">02/29/</set>
        </condition>
        <condition label="March">
          <set token="month2">03/31/</set>
        </condition>
        <condition label="April">
          <set token="month2">04/30/</set>
        </condition>
        <condition label="May">
          <set token="month2">05/31/</set>
        </condition>
        <condition label="June">
          <set token="month2">06/30/</set>
        </condition>
        <condition label="July">
          <set token="month2">07/31/</set>
        </condition>
        <condition label="August">
          <set token="month2">08/31/</set>
        </condition>
        <condition label="September">
          <set token="month2">09/30/</set>
        </condition>
        <condition label="October">
          <set token="month2">10/31/</set>
        </condition>
        <condition label="November">
          <set token="month2">11/30/</set>
        </condition>
        <condition label="December">
          <set token="month2">12/31/</set>
        </condition>
      </change>
    </input>
0 Karma

elomotanpru
Path Finder

This would be good if I could trigger this to when an item has not been clicked on the dropdown input, however I would still need the user's input to change the dates.

Was thinking of a way to make a dropdown containing each month of the year that would be used in the search but dependent on the year selected on another dropdown to make it functional for last years report, this years, and upcoming reports in the future.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I would rename the year token (I am not sure if the value you used works?) - you might have to remove the default too

    <input type="dropdown" token="year">
      <label>Select Year</label>
      <choice value="2022">2022</choice>
    </input>

Then reject the token for the text inputs

    <input type="text" token="from" rejects="$year$">
      <label>From MM/DD/YYYY</label>
      <default>01/01/2022</default>
    </input>
    <input type="text" token="to" rejects="$year$">
      <label>To MM/DD/YYYY</label>
      <default>01/31/2022</default>
    </input>

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...