How to set up a drilldown to pass the selected "pa...

tmarlette · ‎04-28-2015

I am attempting to pass the selected time range of the "pan + zoom" function in simplified XML to another view. meaning that when the timerange picker defaults to 60 minutes, and if a user selects only 15 minutes, then clicks on the chart, the dashboard passes ONLY the selected 15 minutes out of the entire 60 minute selection.

Currently, when I select a time range then click, it takes the entire 60 minute selection,instead of the selected 15 minutes. Contextually, these tokens work fine in the same dashboard, however they don't pass to another view. Does anyone know which tokens I should be using?

Here is my XML:

 <row>
    <panel>
      <chart id="cpu_detail" depends="$host2$">
        <title>Average CPU % Over Time for $host2$   (click to drilldown)</title>
        <searchString>index=myIndex  host=$host2$ collection=CPU counter="% Processor Time" instance=_Total | timechart avg(Value) by host useother=f</searchString>
        <earliestTime>$hist.earliest$</earliestTime>
        <latestTime>$hist.latest$</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.axisTitleY.text">CPU %</option>
        <drilldown>
         <selection>
          <set token="selection.begin">$start$</set>
          <set token="selection.end">$end$</set>
         </selection>
        <link>
            <![CDATA[
                   https://splunk02:8000/en-US/app/myApp/myView?form.whost=$host2$&form.field3.earliest=$selection.begin$&form.field3.latest=$selection.end$]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>

Flynt · ‎04-30-2015

Unfortunately the drilldown will only take the click values. To get past this limitation you can add an HTML panel that displays the correct link. For example -

<dashboard>
    <label>Pan/Zoom test</label>
    <row>
        <panel>
            <chart>
                <title>Pan and Zoom (All source types)</title>
                <searchString>
                    index=_internal | timechart count by sourcetype
                </searchString>
                <earliestTime>-7d@h</earliestTime>
                <latestTime>now</latestTime>
                <selection>
                    <set token="selection_earliest">$start$</set>
                    <set token="selection_latest">$end$</set>
                    <set token="start_splunk_web_access">$start.splunk_web_access$</set>
                    <set token="end_splunk_web_access">$end.splunk_web_access$</set>
                    <set token="url">
                        <![CDATA[ 
  http://localhost:8000/en-US/app/search/search?earliest=$selection_earliest$&latest=$selection_latest... index%3D_internal]]>
                    </set>
                </selection>
            </chart>
            <html>
            <p> <a href="$url$" target="_blank">Link for pan/zoom - $url$</a> </p>

            </html>
        </panel>
    </row>
</dashboard>

Graham_Hanningt · ‎12-19-2019

To return to the previous time range after clicking that link ("Link for pan/zoom"), I have found that I need to click my web browser's Back button twice, because of the way that Splunk Web sets form parameters in the URL query string after loading a dashboard.

When you initially click that link, the browser URL is exactly what $url$ sets it to. But when the dashboard at that URL loads, Splunk Web updates the URL query string ( ?... ) with the dashboard form parameters. This introduces an additional URL to the browser history, hence a second click of the Back button to return to the previous dashboard and its time range.

Or am I missing something?

Graham_Hanningt · ‎12-18-2019

With apologies if this is stating the bleeding obvious: if, as I do, you want the link to set the time range of the current dashboard (to the marquee-selected time range in the chart), then your URL can consist of just the query string:

<set token="url">
    <![CDATA[?earliest=$selection_earliest$&latest=$selection_latest$]]>
</set>

Related note: dashboards that I design these days typically contain a "master" timechart at the top, just under the form UI controls. Only the search for that master timechart and form UI controls refer to the values of the global time picker in the form UI controls:

<earliest>$earliest$</earliest>
<latest>$latest$</latest>

All other searches in the dashboard—all visualizations under that master timechart—refer to the time range selected by that master timechart:

<earliest>$selection_earliest$</earliest>
<latest>$selection_latest$</latest>

The HTML visualization containing the link appears directly under the master timechart.

Having that master timechart at the top offers an easy way to zoom and pan around within the time range set by the time picker.

tmarlette · ‎04-29-2015

Please see this image. This chart is connected to the time-range picker, so $earliest$ and $latest$ will always remain the same, however I want to pass just the time range circled in red, to the next view. Which tokens would I use?

How to set up a drilldown to pass the selected "pan+zoom" time range as a token to another view?

.conf24 | Registration Open!

ICYMI - Check out the latest releases of Splunk Edge Processor

Introducing the 2024 SplunkTrust!