Problem : getting expected value with $click.value$ or $click.value2$

[spatil]

Hi,

I have a line chart for CPU usage over time for different hosts. It shows three different lines for different hosts, say for hostA, hostB and hostC. When user clicks on any of the line for host ,I want to plot a drill down chart for that host. I need to pass the value representing "hostname" to the drill down chart. I tried both ways using $click.value$ and $click.value2$ . But it is giving me the CPU usage value at that point. It is not giving me the host name. Same thing I tried with legend shown. But it is giving null for $click.value$ and $click.value2$.

In above try , I had used ConvertToIntension module.

I am new to splunk , Is there any other way to get such value from the parent graph ?

Can I get the help for the same ?

Regards, S

[sideview · Accepted solution]

You're close, but whenever there's a 'split by' term, that term is actually $click.name2$, not $click.value$ nor $click.value2$.

If you havent already, read through the "ui examples" app's drilldown examples.

in short, $click.value2$, as you have found is almost always a number. So it's not very useful.

$click.name$ is the name of the first column, or the x-axis field name in a chart.

$click.value$ is the value of the first cell, or the x-axis value in a chart.

$click.name2$ is the value of the split-by field, if there is one...

[the_wolverine]

I found my answer by studying the drilldown_chart2 view in the UI Examples.

[sideview]

Sure. Download the "UI Examples" app from splunkbase. Apps > Launcher > Browse other apps > (scroll down a ways) > UI Examples > Install Free. Then restart your server and you'll have it installed. It has about 60 example views each with embedded documentation. It's a little more thorough sometimes than what's in the docs, and it's all living breathing example views that work, so you can play with them yourself and explore.

[spatil]

Your answer solved my problem. But , can you please tell me ,how I can search for all such things ? I had searched splunk base to solve my problem. But I did not get docs saying above answer.
regards,
S