Line chart drilldown question.

[aarzhang]

query:
index=app sourcetype=XXXX eventName=xxx | bucket _time span=1m | stats count as total, count(eval(success="false")) as failureCount by _time, eventName | eval successRate=100*(total-failureCount)/total | xyseries _time eventName successRate

I build a line chart like the image.
Now , I want to add drilldown function, how can I get the eventName when I click down.
I have try $click.value$ , $row.field$, $click.value2$, but failed.

[somesoni2 · Accepted solution]

Since the value that want to capture is the label/field name for y-axis, try using $click.name2$.

See more details here. Open the link and search for "chart (event tokens)"

http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/PanelreferenceforSimplifiedXML#Drilldown_eleme...