Dashboards & Visualizations

Why is the Time Selection not working when I click on a timeseries bar?

robertlynch2020
Motivator

Hi

The <Selection> in the bottom code is not working correctly and I can't figure out why.

I am looking to select the time when I click on a bar on the graph. To give me the time of the bar, however, it is always giving me the start time of the graph and not the zoomed-in time of the bar.

 

 <panel depends="$host_token$">
      <chart>
        <title>Sig Events Error Count by MX Component</title>
        <search>
          <query>| mstats max("mx.process.errors") prestats=true WHERE "index"="metrics_test" AND mx.env=$host_token$ AND log.type=sig-event span=60s BY "log.type" pid replica.name service.name | search "psrsvd_nx_mx.process.errors" &gt; 0
| rename "service.name" as service_name 
| rename "replica.name" as replica_name 
| eval Process_Name=((service_name . " # ") . replica_name) 
| timechart max("mx.process.errors") AS Error_Log_Nb by Process_Name limit=10000 
| eval Error_Log_Nb=substr(Error_Log_Nb, 1, len(Error_Log_Nb)-7)</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>	
		 <selection>
          <set token="time_token_selection.earliest">$start$</set>
          <!--set token="time_token_selection.latest">$end$</set-->
		   <eval token="time_token_selection.latest">$time_token_selection.earliest$+5</eval>
		</selection>		
      </chart>
    </panel>

 

IN the below we can see i am click on the bar

robertlynch2020_0-1645552122723.png

However, the time in the tokens is the start and end, not the time on the bar that i have clicked on.

robertlynch2020_1-1645552158091.png

Regards

Robert 

Labels (3)
0 Karma
1 Solution

robertlynch2020
Motivator

In the end, i had this all wrong - the code needs to be in the drill-down - like below.

 

 <panel depends="$host_token$">
      <title>Significant Events - Last 5m</title>
      <single>
        <search base="Basesearch_SIG_EVENTS">
          <query>
					 
					|  stats count as Errors
				</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">76</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">Sig Event(s)</option>
        <option name="useColors">1</option>
        <drilldown>
           <set token="time_token_selection.earliest">$earliest$</set>
			<set token="time_token_selection.latest">$latest$</set>
            <link target="_blank">http://splunk:8000/en-GB/app/$app_name$/$Dashboard_SIGNIFICANT_EVENTS$?host_token1=$host_token$&amp;URL_TRAP=SET&amp;Severity_token1=*&amp;form.time_token.earliest=$time_token_selection.earliest$&amp;form.time_token.latest=$time_token_selection.latest$&amp;Service_Name1=*</link>
    
        </drilldown>
      </single>
    </panel>

View solution in original post

0 Karma

robertlynch2020
Motivator

In the end, i had this all wrong - the code needs to be in the drill-down - like below.

 

 <panel depends="$host_token$">
      <title>Significant Events - Last 5m</title>
      <single>
        <search base="Basesearch_SIG_EVENTS">
          <query>
					 
					|  stats count as Errors
				</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">76</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">Sig Event(s)</option>
        <option name="useColors">1</option>
        <drilldown>
           <set token="time_token_selection.earliest">$earliest$</set>
			<set token="time_token_selection.latest">$latest$</set>
            <link target="_blank">http://splunk:8000/en-GB/app/$app_name$/$Dashboard_SIGNIFICANT_EVENTS$?host_token1=$host_token$&amp;URL_TRAP=SET&amp;Severity_token1=*&amp;form.time_token.earliest=$time_token_selection.earliest$&amp;form.time_token.latest=$time_token_selection.latest$&amp;Service_Name1=*</link>
    
        </drilldown>
      </single>
    </panel>
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...