Dashboards & Visualizations

Need help with tokenization on timechart for Dashboard Studio v9.3.2

ripvw32
Explorer

Have this query I am using for a visualization: 

<My query strings>

| eval ApiName=upper(ApiName)

| stats earliest(_time) AS StartTime latest(_time) AS EndTime BY correlationId ApiName
| eval DurationInSecs = EndTime - StartTime
| where DurationInSecs >= 0
| eval StartTimeR = StartTime + 30
| bin StartTimeR span=1m
| eval Time = StartTimeR - 30

| eval _time = Time
| timechart span=15m limit=0 useother=f $DurationToken$(DurationInSecs) BY ApiName


I've added an interaction so that when someone clicks on a line or on the legend, it will open a new tab to the desired dashboard (works) and pass the token in to be used in a new query in a new visual in the newly opened dashboard (not working)

Here is the interaction source code:

{...
    "eventHandlers": [
        {
            "type": "drilldown.linkToDashboard",
            "options": {
                "app": "mygroupname_search",
                "dashboard": "my_api_stats__api_drill_down",
                "newTab": true,
                "tokens": [
                    {
                        "token": "ApiNameToken",
                        "value": "row.ApiName.value"
                    }
                ]
            }
        }
    ],
...}
 


However, when I click on the line/legend name for a specific ApiName I get the new dashboard tab opened, but the sent value is the text string 'row.ApiName.value' vs. the ApiName I clicked on/am expecting.

I check to see what the token is carrying via a markdown text box I have on the new dashboard using $ApiNameToken$ in the text box. 

I have zero issues with doing it this way when using anything other than a time chart.

Please help me understand what am I doing incorrectly?

Labels (4)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @ripvw32 

When you do your timechart by apiName you no longer have a column/field called 'apiName' - instead you have column for each apiName in your original search (e.g. API1)

Therefore you cannot use row.apiName.value in your drilldown - instead you can use 'name' which is the name of the field clicked - which should be the apiName value.

{...
    "eventHandlers": [
        {
            "type": "drilldown.linkToDashboard",
            "options": {
                "app": "mygroupname_search",
                "dashboard": "my_api_stats__api_drill_down",
                "newTab": true,
                "tokens": [
                    {
                        "token": "ApiNameToken",
                        "value": "name"
                    }
                ]
            }
        }
    ],
...}

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

ripvw32
Explorer

@livehybrid This is the second time you've really helped me out. Thank you so much!

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @ripvw32 

When you do your timechart by apiName you no longer have a column/field called 'apiName' - instead you have column for each apiName in your original search (e.g. API1)

Therefore you cannot use row.apiName.value in your drilldown - instead you can use 'name' which is the name of the field clicked - which should be the apiName value.

{...
    "eventHandlers": [
        {
            "type": "drilldown.linkToDashboard",
            "options": {
                "app": "mygroupname_search",
                "dashboard": "my_api_stats__api_drill_down",
                "newTab": true,
                "tokens": [
                    {
                        "token": "ApiNameToken",
                        "value": "name"
                    }
                ]
            }
        }
    ],
...}

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...