Is it possible to pass the X-axis value via link target?

[elomotanpru]

Hi again,

Seeking your advise on the topic above. The link target method was suggested to me as a work around on my concern on the standard Splunk chart limitations. However I am unable to find a way to pass link target where in the target is the X-Axis value where in this instance is the specific dates.

For reference, attaching the screenshot of the chart along with the entire XML code.

I have already considered making a separate panel where the dates would be generated but I was wondering if this type pf Link Target would be possible so that I could apply it with my other reports.

<form theme="dark">
  <label>CSC/ERSC/PSI PAGING Report</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="lpar">
      <label>Select to View</label>
      <choice value="----">----</choice>
      <choice value="D7X0">D7X0</choice>
      <choice value="H7X0">H7X0</choice>
      <choice value="D1D0">D1D0</choice>
      <choice value="DAD0">DAD0</choice>
      <choice value="E1D0">E1D0</choice>
      <choice value="H1D0">H1D0</choice>
      <choice value="WSYS">WSYS</choice>
      <choice value="YSYS">YSYS</choice>
      <default>----</default>
    </input>
    <input type="text" token="from">
      <label>From MM/DD/YYYY</label>
      <default>01/01/2022</default>
    </input>
    <input type="text" token="to">
      <label>To MM/DD/YYYY</label>
      <default>01/31/2022</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$lpar$ Date Panel</title>
      <chart>
        <title>From &amp; To Input: $from$ - $to$</title>
        <search>
          <query>index=mainframe-platform sourcetype="mainframe:mpage" 
MVS_SYSTEM_ID=$lpar$
| eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d")
| eval _time=strptime(DATE." ","%Y-%m-%d")
| where _time &gt;= strptime("$from$", "%m/%d/%Y") AND _time &lt;= strptime("$to$", "%m/%d/%Y")
| eval epochtime=strptime(TIME, "%H:%M:%S")| eval desired_time=strftime(epochtime, "%H:%M:%S")
| chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over _time</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.text">Date of Occurrence</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.overlayFields">"D1D0 Sum of VIO_PAGING_SEC","D1D0 SYSTEM_PAGEFAULTS_SEC","D1D0 SWAP_PAGIN_SEC",D1D0_LOCAL_PAGEFAULTS_SEC</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="height">789</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">/app/mainframe-platform/csierscpsi_paging_individual_report?_time=$click.name2$</link>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

[Software-Simian]

Not quite sure what you want to save to the token...

If wou want the clumn bar at the point of the x axis use Whisperes method, thatworks likje a charme in dozens of my dashs.

If you want to pass the Timestamp than this is a bit more tricky und not sure if at all possible via single click.

However, you can try:

<selection>
<set token="selection.earliest">$start$</set>
<set token="selection.latest">$end$</set>
</selection>

This works by holding your left mouse button in the chart and selecting the timewindow by dragging.

[ITWhisperer · Accepted solution]

Try $click.value$

[elomotanpru]

Thanks this worked. 

Just an additional question though, is there a way to truncate $click.name2$? I am trying to pass this value however I will only bee needing the first 4 characters from the left. Attaching a screenshot of what my display value received.

[ITWhisperer]

eval a token in the drilldown and use that token in the link

<eval token="shortened">substr($click.name2$,1,4)</eval>

[elomotanpru]

Did I understand and place this correctly? Still receiving the entire string.

        <drilldown>
          <eval token="shortened">substr($click.name2$,1,4)</eval>
          <link target="_blank">/app/mainframe-platform/csierscpsi_paging_individual_report?DATE=$click.value$&amp;MVS_SYSTEM_ID=$click.name2$</link>
        </drilldown>

[ITWhisperer]

       <drilldown>
          <eval token="shortened">substr($click.name2$,1,4)</eval>
          <link target="_blank">/app/mainframe-platform/csierscpsi_paging_individual_report?DATE=$click.value$&amp;MVS_SYSTEM_ID=$shortened$</link>
        </drilldown>

[elomotanpru]

Thank you for this, it was a huge help. Will try using the same method for past and future projects.