LineChart drilldown

[vikas_sood]

Hi,

i have added a line chart with drilldowns on a Splunk dashboard.

When I click on any on the data points on this chart, other line disappears. How can both the lines be kept intact during drilldowns? 

[ITWhisperer]

Can you share your dashboard code?

[vikas_sood]

<?xml version="1.0" encoding="UTF-8"?>
<form>
   <label>Dashboard</label>
   <init>
      <set token="dname">*</set>
      <set token="shost">*</set>
   </init>

   <row>
      <panel id="pie">
         <title>pie</title>
         <chart>
            <search>
               <query>**************************************</query>
               <earliest>-4h@m</earliest>
               <latest>now</latest>
            </search>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.visibility">visible</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.backgroundColor">#ffffff00</option>
            <option name="charting.chart">pie</option>
            <option name="charting.chart.showPercent">1</option>
            <option name="charting.drilldown">all</option>
            <option name="charting.legend.placement">right</option>
            <option name="trellis.enabled">0</option>
            <option name="trellis.size">small</option>
            <drilldown>
               <set token="dname">$click.value$</set>
               <set token="shost">*</set>
               <eval token="drilldown.earliest">$earliest$</eval>
               <eval token="drilldown.latest">$latest$</eval>
            </drilldown>
         </chart>
      </panel>
      <panel id="timechart">
         <title>query</title>
         <chart>
            <search>
               <query>**************************************</query>
               <earliest>-4h@m</earliest>
               <refresh>1m</refresh>
               <latest>now</latest>
            </search>
            <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
            <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.text"># of Errors</option>
            <option name="charting.axisTitleY.visibility">visible</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.axisY.abbreviation">none</option>
            <option name="charting.chart">line</option>
            <option name="charting.chart.showDataLabels">none</option>
            <option name="charting.chart.showPercent">1</option>
            <option name="charting.drilldown">all</option>
            <option name="charting.legend.placement">right</option>
            <option name="trellis.enabled">0</option>
            <option name="trellis.size">small</option>
            <option name="charting.backgroundColor">#ffffff00</option>
            <drilldown>
               <eval token="drilldown.earliest">$earliest$</eval>
               <eval token="drilldown.latest">$latest$</eval>
               <set token="shost">$click.name2$</set>
            </drilldown>
         </chart>
      </panel>
   </row>
   <row>
      <panel>
         <event>
            <title>events</title>
            <search>
               <query>***************************************</query>
               <earliest>$drilldown.earliest$</earliest>
               <latest>$drilldown.latest$</latest>
               <refresh>1m</refresh>
               <refreshType>delay</refreshType>
            </search>
            <option name="list.drilldown">full</option>
            <option name="raw.drilldown">none</option>
            <option name="refresh.display">progressbar</option>
            <option name="rowNumbers">1</option>
            <option name="table.drilldown">none</option>
            <option name="type">list</option>
         </event>
      </panel>
   </row>
</form>

[ITWhisperer]

Unfortunately, you have redacted some of the useful information, so I would have to guess that you use  ***** in your search query ************* which is reset by the drilldown, thereby removing it from the search results 😀 - my guess is that ***** is $shost$ - try using a different token name for transferring the selection from one panel to the next

[vikas_sood]

Worked...changed shost to shost1 in timechart and events panel.