Dashboards & Visualizations

How to have Sankey diagram drilldown to set form tokens?

Graham_Hanningt
Builder

I am using Splunk 8.1.0 with the Sankey Diagram 1.5.0 app.

I have a sankey diagram viz in a dashboard. The source and target fields of the sankey correspond to  dashboard form inputs that I use to filter queries.

When the dashboard user clicks on the left side of the sankey diagram (a source field value), I want to set the corresponding form input to that value.

Similarly, when the user clicks on the right side of the sankey diagram (a target field value), I want to set the corresponding form input to that value.

How do I do that?

I've tried:

 

 

 

 

<drilldown>
  <condition field="source">
    <set token="form.applid">$click.name2$</set>
    <set token="applid">APPLID="$click.name2$"</set>
  </condition>
  <condition field="target">
    <set token="form.poolid">$click.name2$</set>
    <set token="applid">"ENQ Pool ID"="$click.name2$"</set>
  </condition>
</drilldown>

 

 

 

 

 

(where "applid" and "poolid" are the tokens set by the form inputs, and also the corresponding form input id attribute values)

but that navigates to a new tab with a new search that has the "set" values appended:

... APPLID=TXCQAIC "ENQ Pool ID"=EXECSTRN

I don't want to navigate to a new window. I want to remain on the same dashboard, and just update the form inputs and their corresponding tokens.

Labels (1)
Tags (3)
0 Karma

duncan_
New Member

Late to this discussion, but posting the answer here for any folks who search this up later.

After some testing, I found that the Sankey drilldown tokens use the $row.Field Name$ format:

      <viz type="sankey_diagram_app.sankey_diagram">
        <search>
          <query>... | stats sum(bytes) as total_bytes count by source target</query>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="form.source_tok">$row.source$</set>
          <set token="form.target_tok">$row.target$</set>
        </drilldown>
      </viz>

 

I don't believe there's a way to distinguish between a click on the source versus the target, so field conditions don't seem to work like they would for a table.

Tags (2)
0 Karma

izyknows
Path Finder

Did you find a way to do this? I'm looking for it as well. $click.value$ and $click.value2$ don't seem to work with Sankey diagrams. When I try to set them using

<drilldown>
          <set token="show_panel">true</set>
          <set token="local">$click.value$</set>
          <set token="test2">$click.value2$</set>
</drilldown>

It seems upon click, I see an action taking place but the variables are just displayed as $click.value$, i.e, they don't take any value from the Sankey diagram.

If i find something that works, I'll post back here for the next poor soul.

0 Karma
Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...