Dashboards & Visualizations

Is it possible to pass the X-axis value via link target?

elomotanpru
Path Finder

Hi again,

Seeking your advise on the topic above. The link target method was suggested to me as a work around on my concern on the standard Splunk chart limitations. However I am unable to find a way to pass link target where in the target is the X-Axis value where in this instance is the specific dates.

For reference, attaching the screenshot of the chart along with the entire XML code.

I have already considered making a separate panel where the dates would be generated but I was wondering if this type pf Link Target would be possible so that I could apply it with my other reports.

 

 

<form theme="dark">
  <label>CSC/ERSC/PSI PAGING Report</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="lpar">
      <label>Select to View</label>
      <choice value="----">----</choice>
      <choice value="D7X0">D7X0</choice>
      <choice value="H7X0">H7X0</choice>
      <choice value="D1D0">D1D0</choice>
      <choice value="DAD0">DAD0</choice>
      <choice value="E1D0">E1D0</choice>
      <choice value="H1D0">H1D0</choice>
      <choice value="WSYS">WSYS</choice>
      <choice value="YSYS">YSYS</choice>
      <default>----</default>
    </input>
    <input type="text" token="from">
      <label>From MM/DD/YYYY</label>
      <default>01/01/2022</default>
    </input>
    <input type="text" token="to">
      <label>To MM/DD/YYYY</label>
      <default>01/31/2022</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$lpar$ Date Panel</title>
      <chart>
        <title>From &amp; To Input: $from$ - $to$</title>
        <search>
          <query>index=mainframe-platform sourcetype="mainframe:mpage" 
MVS_SYSTEM_ID=$lpar$
| eval DATE=strftime(strptime(DATE,"%d%b%Y"),"%Y-%m-%d")
| eval _time=strptime(DATE." ","%Y-%m-%d")
| where _time &gt;= strptime("$from$", "%m/%d/%Y") AND _time &lt;= strptime("$to$", "%m/%d/%Y")
| eval epochtime=strptime(TIME, "%H:%M:%S")| eval desired_time=strftime(epochtime, "%H:%M:%S")
| chart sum(VIO_PAGING_SEC) as "$lpar$ Sum of VIO_PAGING_SEC" sum(SYSTEM_PAGEFAULTS_SEC) as "$lpar$ SYSTEM_PAGEFAULTS_SEC" sum(SWAP_PAGIN_SEC) as "$lpar$ SWAP_PAGIN_SEC" sum(LOCAL_PAGEFAULTS_SEC) as "$lpar$ LOCAL_PAGEFAULTS_SEC" over _time</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
        <option name="charting.axisTitleX.text">Date of Occurrence</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.overlayFields">"D1D0 Sum of VIO_PAGING_SEC","D1D0 SYSTEM_PAGEFAULTS_SEC","D1D0 SWAP_PAGIN_SEC",D1D0_LOCAL_PAGEFAULTS_SEC</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="height">789</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">/app/mainframe-platform/csierscpsi_paging_individual_report?_time=$click.name2$</link>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

 

 

elomotanpru_0-1653429023041.png

 

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try $click.value$

View solution in original post

Software-Simian
Path Finder

Not quite sure what you want to save to the token...

If wou want the clumn bar at the point of the x axis use Whisperes method, thatworks likje a charme in dozens of my dashs.

 

If you want to pass the Timestamp than this is a bit more tricky und not sure if at all possible via single click.

 

However, you can try:

 

<selection>
<set token="selection.earliest">$start$</set>
<set token="selection.latest">$end$</set>
</selection>

 

This works by holding your left mouse button in the chart and selecting the timewindow by dragging.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try $click.value$

elomotanpru
Path Finder

Thanks this worked. 

Just an additional question though, is there a way to truncate $click.name2$? I am trying to pass this value however I will only bee needing the first 4 characters from the left. Attaching a screenshot of what my display value received.

elomotanpru_0-1653501440268.png

elomotanpru_1-1653501590956.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

eval a token in the drilldown and use that token in the link

<eval token="shortened">substr($click.name2$,1,4)</eval>
0 Karma

elomotanpru
Path Finder

Did I understand and place this correctly? Still receiving the entire string.

        <drilldown>
          <eval token="shortened">substr($click.name2$,1,4)</eval>
          <link target="_blank">/app/mainframe-platform/csierscpsi_paging_individual_report?DATE=$click.value$&amp;MVS_SYSTEM_ID=$click.name2$</link>
        </drilldown>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
       <drilldown>
          <eval token="shortened">substr($click.name2$,1,4)</eval>
          <link target="_blank">/app/mainframe-platform/csierscpsi_paging_individual_report?DATE=$click.value$&amp;MVS_SYSTEM_ID=$shortened$</link>
        </drilldown>

elomotanpru
Path Finder

Thank you for this, it was a huge help. Will try using the same method for past and future projects.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...