Dashboards & Visualizations

Why is chart drilldown earliest and latest time not working?

wangkevin1029
Communicator

Hi, Splunkers, 

I  have the following table drilldown earliest and latest time works properly.

but when I copied it to a chart drilldown, it stopped working.

I noticed table drilldown has the following drilldown option value= row.

<option name="drilldown">row</option>

and the link for passing  earliest and latest time uses row.StartDTM_epoch,  and  row.EndDTM_epoch

form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$

 

I noticed my chart drilldown has the following drilldown option value= all.

<option name="drilldown">all</option>

so, I changed it to form.field2.earliest=$all.StartDTM_epoch$&form.field2.latest=$all.EndDTM_epoch$

not sure if the all.StartDTM_epoch and all.EndDTM_epoch casusing the failure.

 

 

the following is the related working code for table drilldown to pass earliest and latest time.


| eval StartDTM_epoch = relative_time(_time,"-20m")
| eval EndDTM_epoch = relative_time(_time,"+20m")

| eval TIME = strftime(_time, "%Y-%m-%d %H:%M:%S")

| table _time,sid,Type,AgentName,DN,FAddress,Segment,Function,Client,Product,SubFunction,SubFDetail,MKTGCT,CCType,VQ,TLCnt,AFRoute,StateCD,TargetSelected,AFStatus,,CBOffered,CBRejected,AQT,EWT,EWTmin,PIQ,WT,LSInRange,LSPriority,LSRateS,PB,PCSS,PENT,PF,RONA,LANG,StartDTM_epoch,EndDTM_epoch</query>
<earliest>$field2.earliest$</earliest>
<latest>$field2.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<fields>["_time","sid","Type","AgentName","DN","FAddress","Segment","Function","Client","Product","SubFunction","SubFDetail","MKTGCT","CCType","VQ","TLCnt","AFRoute","StateCD","TargetSelected","AFStatus","CBOffered","CBRejected","AQT","EWT","EWTmin","PIQ","WT","LSInRange","LSPriority","LSRateS","PB","PCSS","PENT","PF","RONA","LANG"]</fields>
<drilldown>
<condition match="$t_DrillDown$ = &quot;*&quot;">
<link target="_blank">
<![CDATA[
/app/optum_gvp/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token_with2handlers=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$
]]>
</link>

 

thx in advance.

 

Kevin

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Table uses drilldown row or cell and chart uses all, but you don't use "all" for referencing row values, it is still $row.xxx$ 

Look at the chart section here

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#Predefined_dr...

It depends where you click in a chart as to the tokens/values you get.

What fields do you have in your data and what is the search for the chart?

0 Karma

wangkevin1029
Communicator

bowesmana,

 

I copied these earliest and latest time code from my table query, which works fine for table.

the only difference is drilldown option,  for table,  value = row, for chart , value=all.

 

Kevin

0 Karma

wangkevin1029
Communicator

Hi, bowesmana,

 

thx for your quick response.

it's the same chart as the last case  about chart input.  you helped me fix that issue.

still passed   $click.name2$ as input.

for earliest, and latest time,  I tried  all.StartDTM_epoch,  row.StartDTM_epoch, and StartDTM_epoch without prefix.

form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$

  

 

Kevin

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What sort of chart and what is your XML definition for that chart?

Just copying table to chart does not mean it will work, for example <fields> is not a valid entry for chart and pie charts, for example, do not support use of $row.XXX$ for drilldown, so please provide the chart detail.

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...