Dashboards & Visualizations

Splunk Dashboard Studio maps not capture click

arlissilva
Engager

Hello, I am building a dashboard in Splunk Enterprise, I included the map with the Choropleth layer type and that worked for me, but I have a table that performs a query based on the region clicked on the map and that part does not work in Splunk Dashboard Studio. I have already defined the token on the map, adjusted the token in the table's query, and it seems that it does not capture the clicked area. I did the same process in Splunk Classic and it worked as expected.

 

below is the source code of the MAP

image.png

{
    "dataSources": {
        "primary": "ds_4lhwtNWq"
    },
    "eventHandlers": [
        {
            "type": "drilldown.setToken",
            "options": {
                "tokens": [
                    {
                        "key": "row.UF.value",
                        "token": "clicked_uf"
                    }
                ]
            }
        }
    ],
    "options": {
        "backgroundColor": "#294e70",
        "center": [
            -13.79021870397439,
            -52.07072204233867
        ],
        "layers": [
            {
                "additionalTooltipFields": [
                    "Quantidade de erros"
                ],
                "areaIds": "> primary | seriesByName('UF')",
                "areaValues": "> primary | seriesByName('Quantidade de erros')",
                "bubbleSize": "> primary | frameBySeriesNames('Quantidade de erros')",
                "choroplethOpacity": 0.5,
                "choroplethStrokeColor": "transparent",
                "latitude": "> primary | seriesByName('LATITUDE')",
                "longitude": "> primary | seriesByName('LONGITUDE')",
                "resultLimit": 50000,
                "type": "choropleth"
            }
        ],
        "scaleUnit": "imperial",
        "zoom": 5.38493379665208
    },
    "title": "mapa",
    "type": "splunk.map",
    "context": {},
    "containerOptions": {},
    "showProgressBar": false,
    "showLastUpdated": false
}

 

below is the SPL query of the table:

index=<index> coderropc="0332"
| eval PC = replace(codpcredeprop, "^0+", "")
| stats count as "Erros por PC" by PC
| join type=left PC [| inputlookup PcFabricante.csv | eval CODPC=replace(CODPC, "^0+", "") | rename CODPC as PC | fields PC NOMEFABR MODELO]
| join type=left PC [| search index=ars source=GO earliest=-30d@d latest=now | eval CODPC=replace(CODPC, "^0+", "") | rename CODPC as PC | fields PC UF]
| search UF="$token_mapa$"
| table PC, NOMEFABR, MODELO, UF, "Erros por PC"

 

Is there any configuration that is different between Splunk classic and Splunk Dashboard Studio? When I add the default value in the map, the table receives the value, but does not register the clicks.

Labels (3)
0 Karma

livehybrid
Super Champion

Hi @arlissilva 

It looks like your table SPL uses "token_mapa" but the token you are setting is "clicked_uf". If you update these do you get the same issue?

Assuming that UF is a valid field in the map results then the clicked_uf value should be updated, do you see this update in your browser URL?

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

arlissilva
Engager

Hi @livehybrid , thank you very much for the reply, I corrected the 'clicked_uf' in my SPL table, it was my oversight, but the problem persists. Regarding my URL not updating with the clicked_uf, it doesn't even appear in the MAPA URL, it seems that it doesn't recognize the click.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...