Dashboards & Visualizations

Need help with tokenization on timechart for Dashboard Studio v9.3.2

ripvw32
Explorer

Have this query I am using for a visualization: 

<My query strings>

| eval ApiName=upper(ApiName)

| stats earliest(_time) AS StartTime latest(_time) AS EndTime BY correlationId ApiName
| eval DurationInSecs = EndTime - StartTime
| where DurationInSecs >= 0
| eval StartTimeR = StartTime + 30
| bin StartTimeR span=1m
| eval Time = StartTimeR - 30

| eval _time = Time
| timechart span=15m limit=0 useother=f $DurationToken$(DurationInSecs) BY ApiName


I've added an interaction so that when someone clicks on a line or on the legend, it will open a new tab to the desired dashboard (works) and pass the token in to be used in a new query in a new visual in the newly opened dashboard (not working)

Here is the interaction source code:

{...
    "eventHandlers": [
        {
            "type": "drilldown.linkToDashboard",
            "options": {
                "app": "mygroupname_search",
                "dashboard": "my_api_stats__api_drill_down",
                "newTab": true,
                "tokens": [
                    {
                        "token": "ApiNameToken",
                        "value": "row.ApiName.value"
                    }
                ]
            }
        }
    ],
...}
 


However, when I click on the line/legend name for a specific ApiName I get the new dashboard tab opened, but the sent value is the text string 'row.ApiName.value' vs. the ApiName I clicked on/am expecting.

I check to see what the token is carrying via a markdown text box I have on the new dashboard using $ApiNameToken$ in the text box. 

I have zero issues with doing it this way when using anything other than a time chart.

Please help me understand what am I doing incorrectly?

Labels (4)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @ripvw32 

When you do your timechart by apiName you no longer have a column/field called 'apiName' - instead you have column for each apiName in your original search (e.g. API1)

Therefore you cannot use row.apiName.value in your drilldown - instead you can use 'name' which is the name of the field clicked - which should be the apiName value.

{...
    "eventHandlers": [
        {
            "type": "drilldown.linkToDashboard",
            "options": {
                "app": "mygroupname_search",
                "dashboard": "my_api_stats__api_drill_down",
                "newTab": true,
                "tokens": [
                    {
                        "token": "ApiNameToken",
                        "value": "name"
                    }
                ]
            }
        }
    ],
...}

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

ripvw32
Explorer

@livehybrid This is the second time you've really helped me out. Thank you so much!

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @ripvw32 

When you do your timechart by apiName you no longer have a column/field called 'apiName' - instead you have column for each apiName in your original search (e.g. API1)

Therefore you cannot use row.apiName.value in your drilldown - instead you can use 'name' which is the name of the field clicked - which should be the apiName value.

{...
    "eventHandlers": [
        {
            "type": "drilldown.linkToDashboard",
            "options": {
                "app": "mygroupname_search",
                "dashboard": "my_api_stats__api_drill_down",
                "newTab": true,
                "tokens": [
                    {
                        "token": "ApiNameToken",
                        "value": "name"
                    }
                ]
            }
        }
    ],
...}

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...