Dashboards & Visualizations

Why is the Time Selection not working when I click on a timeseries bar?

robertlynch2020
Influencer

Hi

The <Selection> in the bottom code is not working correctly and I can't figure out why.

I am looking to select the time when I click on a bar on the graph. To give me the time of the bar, however, it is always giving me the start time of the graph and not the zoomed-in time of the bar.

 

 <panel depends="$host_token$">
      <chart>
        <title>Sig Events Error Count by MX Component</title>
        <search>
          <query>| mstats max("mx.process.errors") prestats=true WHERE "index"="metrics_test" AND mx.env=$host_token$ AND log.type=sig-event span=60s BY "log.type" pid replica.name service.name | search "psrsvd_nx_mx.process.errors" &gt; 0
| rename "service.name" as service_name 
| rename "replica.name" as replica_name 
| eval Process_Name=((service_name . " # ") . replica_name) 
| timechart max("mx.process.errors") AS Error_Log_Nb by Process_Name limit=10000 
| eval Error_Log_Nb=substr(Error_Log_Nb, 1, len(Error_Log_Nb)-7)</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>	
		 <selection>
          <set token="time_token_selection.earliest">$start$</set>
          <!--set token="time_token_selection.latest">$end$</set-->
		   <eval token="time_token_selection.latest">$time_token_selection.earliest$+5</eval>
		</selection>		
      </chart>
    </panel>

 

IN the below we can see i am click on the bar

robertlynch2020_0-1645552122723.png

However, the time in the tokens is the start and end, not the time on the bar that i have clicked on.

robertlynch2020_1-1645552158091.png

Regards

Robert 

Labels (3)
0 Karma
1 Solution

robertlynch2020
Influencer

In the end, i had this all wrong - the code needs to be in the drill-down - like below.

 

 <panel depends="$host_token$">
      <title>Significant Events - Last 5m</title>
      <single>
        <search base="Basesearch_SIG_EVENTS">
          <query>
					 
					|  stats count as Errors
				</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">76</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">Sig Event(s)</option>
        <option name="useColors">1</option>
        <drilldown>
           <set token="time_token_selection.earliest">$earliest$</set>
			<set token="time_token_selection.latest">$latest$</set>
            <link target="_blank">http://splunk:8000/en-GB/app/$app_name$/$Dashboard_SIGNIFICANT_EVENTS$?host_token1=$host_token$&amp;URL_TRAP=SET&amp;Severity_token1=*&amp;form.time_token.earliest=$time_token_selection.earliest$&amp;form.time_token.latest=$time_token_selection.latest$&amp;Service_Name1=*</link>
    
        </drilldown>
      </single>
    </panel>

View solution in original post

0 Karma

robertlynch2020
Influencer

In the end, i had this all wrong - the code needs to be in the drill-down - like below.

 

 <panel depends="$host_token$">
      <title>Significant Events - Last 5m</title>
      <single>
        <search base="Basesearch_SIG_EVENTS">
          <query>
					 
					|  stats count as Errors
				</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">76</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">Sig Event(s)</option>
        <option name="useColors">1</option>
        <drilldown>
           <set token="time_token_selection.earliest">$earliest$</set>
			<set token="time_token_selection.latest">$latest$</set>
            <link target="_blank">http://splunk:8000/en-GB/app/$app_name$/$Dashboard_SIGNIFICANT_EVENTS$?host_token1=$host_token$&amp;URL_TRAP=SET&amp;Severity_token1=*&amp;form.time_token.earliest=$time_token_selection.earliest$&amp;form.time_token.latest=$time_token_selection.latest$&amp;Service_Name1=*</link>
    
        </drilldown>
      </single>
    </panel>
0 Karma
Get Updates on the Splunk Community!

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...

Video | Welcome Back to Smartness, Pedro

Remember Splunk Community member, Pedro Borges? If you tuned into Episode 2 of our Smartness interview series, ...

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...