Hi All,
I have written a query where I am selecting name of the user and device using regex. While trying to do drill down in splunk dashboard i'm unable to get results for name and device.
Also i have tried using click.name and click.value but results are not populating.
Please find below the query and snap of source:-
index=* source="/export/home//apawatch."
| rex field=source "^\/export\/home\/(?\w+)\/apawatch.(?\w+)$"
| timechart count by device
Source:-
<panel>
<title>Total Events by Name</title>
<chart>
<search>
<query>index=* source="/export/home/*/apawatch.*"
| rex field=source "^\/export\/home\/(?<name>\w+)\/apawatch\.(?<device>\w+)$$"
| timechart count by name</query>
<earliest>$timeselected.earliest$</earliest>
<latest>$timeselected.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<set token="name">$click.name$</set>
</drilldown>
</chart>
</panel>
<panel>
<title>Events by Device</title>
<chart>
<search>
<query>index=* source="/export/home/*/apawatch.*"
| rex field=source "^\/export\/home\/(?<name>\w+)\/apawatch\.(?<device>\w+)$$"
| timechart count by device</query>
<earliest>$timeselected.earliest$</earliest>
<latest>$timeselected.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<set token="device">$click.name$</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel depends="$name$">
<table>
<title>Events By Name</title>
<search>
<query>index=* source="/export/home/*/apawatch.*" earliest=-1m latest=now name="$name$"
| rex field=source "^\/export\/home\/(?<name>\w+)\/apawatch\.(?<device>\w+)$$"
| table _time,name </query>
<earliest></earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="name">$row.<fieldname>$</set>
</drilldown>
</table>
</panel>
<panel depends="$device$">
<table>
<title>Event By Device</title>
<search>
<query>index=* source="/export/home/*/apawatch.*" earliest=-1m latest=now device="$device$"
| rex field=source "^\/export\/home\/(?<name>\w+)\/apawatch\.(?<device>\w+)$$"
| table _time,device</query>
<earliest></earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
Thanks in advance 🙂
@niks987,
$click.name$
is a predefined token which provides you the leftmost field (column) name in the table or in case of a chart , X-axis field or category name for the clicked location.
Refer - https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/PanelreferenceforSimplifiedXML#Predefined_dri...
To get the field value of field name
, use $row.name$
i.e.
<drilldown>
<set token="name">$row.name$</set>
</drilldown>
Similarly for device, use $row.device$
@niks987,
$click.name$
is a predefined token which provides you the leftmost field (column) name in the table or in case of a chart , X-axis field or category name for the clicked location.
Refer - https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/PanelreferenceforSimplifiedXML#Predefined_dri...
To get the field value of field name
, use $row.name$
i.e.
<drilldown>
<set token="name">$row.name$</set>
</drilldown>
Similarly for device, use $row.device$
I tried using $row.name$ but still its not working.
@niks987, sorry overlooked at the visualization.
Try click.name2
<set token="name">$click.name2$</set>
Here is a run anywhere example with the drilldown on stacked column chart. Clicking on the graph gives back the corresponding name in the title.
<dashboard>
<label>Name Drilldown</label>
<row>
<panel>
<title>$name$</title>
<chart>
<search>
<query>index=_internal|rex field=source "(?<name>.+).log"|timechart count by name</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<set token="name">$click.name2$</set>
</drilldown>
</chart>
</panel>
</row>
</dashboard>