Dashboards & Visualizations

LineChart drilldown

vikas_sood
Explorer

Hi,

i have added a line chart with drilldowns on a Splunk dashboard.

image.png

When I click on any on the data points on this chart, other line disappears. How can both the lines be kept intact during drilldowns? 

 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share your dashboard code?

0 Karma

vikas_sood
Explorer
<?xml version="1.0" encoding="UTF-8"?>
<form>
   <label>Dashboard</label>
   <init>
      <set token="dname">*</set>
      <set token="shost">*</set>
   </init>

   <row>
      <panel id="pie">
         <title>pie</title>
         <chart>
            <search>
               <query>**************************************</query>
               <earliest>-4h@m</earliest>
               <latest>now</latest>
            </search>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.visibility">visible</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.backgroundColor">#ffffff00</option>
            <option name="charting.chart">pie</option>
            <option name="charting.chart.showPercent">1</option>
            <option name="charting.drilldown">all</option>
            <option name="charting.legend.placement">right</option>
            <option name="trellis.enabled">0</option>
            <option name="trellis.size">small</option>
            <drilldown>
               <set token="dname">$click.value$</set>
               <set token="shost">*</set>
               <eval token="drilldown.earliest">$earliest$</eval>
               <eval token="drilldown.latest">$latest$</eval>
            </drilldown>
         </chart>
      </panel>
      <panel id="timechart">
         <title>query</title>
         <chart>
            <search>
               <query>**************************************</query>
               <earliest>-4h@m</earliest>
               <refresh>1m</refresh>
               <latest>now</latest>
            </search>
            <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
            <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.text"># of Errors</option>
            <option name="charting.axisTitleY.visibility">visible</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.axisY.abbreviation">none</option>
            <option name="charting.chart">line</option>
            <option name="charting.chart.showDataLabels">none</option>
            <option name="charting.chart.showPercent">1</option>
            <option name="charting.drilldown">all</option>
            <option name="charting.legend.placement">right</option>
            <option name="trellis.enabled">0</option>
            <option name="trellis.size">small</option>
            <option name="charting.backgroundColor">#ffffff00</option>
            <drilldown>
               <eval token="drilldown.earliest">$earliest$</eval>
               <eval token="drilldown.latest">$latest$</eval>
               <set token="shost">$click.name2$</set>
            </drilldown>
         </chart>
      </panel>
   </row>
   <row>
      <panel>
         <event>
            <title>events</title>
            <search>
               <query>***************************************</query>
               <earliest>$drilldown.earliest$</earliest>
               <latest>$drilldown.latest$</latest>
               <refresh>1m</refresh>
               <refreshType>delay</refreshType>
            </search>
            <option name="list.drilldown">full</option>
            <option name="raw.drilldown">none</option>
            <option name="refresh.display">progressbar</option>
            <option name="rowNumbers">1</option>
            <option name="table.drilldown">none</option>
            <option name="type">list</option>
         </event>
      </panel>
   </row>
</form>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Unfortunately, you have redacted some of the useful information, so I would have to guess that you use  ***** in your search query ************* which is reset by the drilldown, thereby removing it from the search results :grinning_face: - my guess is that ***** is $shost$ - try using a different token name for transferring the selection from one panel to the next

vikas_sood
Explorer

Worked...changed shost to shost1 in timechart and events panel.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...