Dashboards & Visualizations

Why is the Time Selection not working when I click on a timeseries bar?

robertlynch2020
Motivator

Hi

The <Selection> in the bottom code is not working correctly and I can't figure out why.

I am looking to select the time when I click on a bar on the graph. To give me the time of the bar, however, it is always giving me the start time of the graph and not the zoomed-in time of the bar.

 

 <panel depends="$host_token$">
      <chart>
        <title>Sig Events Error Count by MX Component</title>
        <search>
          <query>| mstats max("mx.process.errors") prestats=true WHERE "index"="metrics_test" AND mx.env=$host_token$ AND log.type=sig-event span=60s BY "log.type" pid replica.name service.name | search "psrsvd_nx_mx.process.errors" &gt; 0
| rename "service.name" as service_name 
| rename "replica.name" as replica_name 
| eval Process_Name=((service_name . " # ") . replica_name) 
| timechart max("mx.process.errors") AS Error_Log_Nb by Process_Name limit=10000 
| eval Error_Log_Nb=substr(Error_Log_Nb, 1, len(Error_Log_Nb)-7)</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>	
		 <selection>
          <set token="time_token_selection.earliest">$start$</set>
          <!--set token="time_token_selection.latest">$end$</set-->
		   <eval token="time_token_selection.latest">$time_token_selection.earliest$+5</eval>
		</selection>		
      </chart>
    </panel>

 

IN the below we can see i am click on the bar

robertlynch2020_0-1645552122723.png

However, the time in the tokens is the start and end, not the time on the bar that i have clicked on.

robertlynch2020_1-1645552158091.png

Regards

Robert 

Labels (3)
0 Karma
1 Solution

robertlynch2020
Motivator

In the end, i had this all wrong - the code needs to be in the drill-down - like below.

 

 <panel depends="$host_token$">
      <title>Significant Events - Last 5m</title>
      <single>
        <search base="Basesearch_SIG_EVENTS">
          <query>
					 
					|  stats count as Errors
				</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">76</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">Sig Event(s)</option>
        <option name="useColors">1</option>
        <drilldown>
           <set token="time_token_selection.earliest">$earliest$</set>
			<set token="time_token_selection.latest">$latest$</set>
            <link target="_blank">http://splunk:8000/en-GB/app/$app_name$/$Dashboard_SIGNIFICANT_EVENTS$?host_token1=$host_token$&amp;URL_TRAP=SET&amp;Severity_token1=*&amp;form.time_token.earliest=$time_token_selection.earliest$&amp;form.time_token.latest=$time_token_selection.latest$&amp;Service_Name1=*</link>
    
        </drilldown>
      </single>
    </panel>

View solution in original post

0 Karma

robertlynch2020
Motivator

In the end, i had this all wrong - the code needs to be in the drill-down - like below.

 

 <panel depends="$host_token$">
      <title>Significant Events - Last 5m</title>
      <single>
        <search base="Basesearch_SIG_EVENTS">
          <query>
					 
					|  stats count as Errors
				</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">76</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">Sig Event(s)</option>
        <option name="useColors">1</option>
        <drilldown>
           <set token="time_token_selection.earliest">$earliest$</set>
			<set token="time_token_selection.latest">$latest$</set>
            <link target="_blank">http://splunk:8000/en-GB/app/$app_name$/$Dashboard_SIGNIFICANT_EVENTS$?host_token1=$host_token$&amp;URL_TRAP=SET&amp;Severity_token1=*&amp;form.time_token.earliest=$time_token_selection.earliest$&amp;form.time_token.latest=$time_token_selection.latest$&amp;Service_Name1=*</link>
    
        </drilldown>
      </single>
    </panel>
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...