Dashboards & Visualizations

Why isn't drilldown showing the correct result?

aditsss
Motivator

Hi All,

I have created one panel where I am showing  ERRORS for the app in bar chart format

Below is my query. I have also made drilldown value as clickable 

<query>index=eabc ns=blazepsfpublish CASE(ERROR) |rex field=_raw "(?&lt;!LogLevel=)ERROR(?&lt;Error_Message&gt;.*)" | eval Date=strftime(_time, "%Y-%m-%d") |dedup Error_Message |timechart span=1d count(Error_Message) by app_name</query>

<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option><option name="charting.drilldown">all</option>

<drilldown>
<set token="show">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>

Currently I am only getting Number of Error in Bar chart format.

I want when I click on bar chart it should show raw logs for the Error.

I have created dependent panel with below query but its not showing raw logs:

<panel depends="$show$">
<table>
<title>Errors</title>
<search>
<query>index=abc ns=blazepsfpublish CASE(ERROR)|rex field=_raw "(?&lt;!LogLevel=)ERROR(?&lt;Error_Message&gt;.*)" | eval Date=strftime(_time, "%Y-%m-%d") |dedup Error_Message |timechart span=1d count(Error_Message) by app_name $selected_value$ </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
</table>
</panel>

Can someone guide me here.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to do here

Your first query has a timechart span=1d by app_name, therefore you will have bars for each day for each app.

When you click on a bar, you will have a number of tokens available in the drilldown to indicate where on the chart the user clicked: $click.value$ (as you have used in your example) will contain the value of the day the user clicked; $click.name2$ will contain the name of the series i.e. the app_name.

You can use these to set tokens to pass to your second query.

Your second query also has a timechart command, so it is not going to show the raw events. You should determine what the search for the second panel needs to look like to show the data you want, then use the tokens from the drilldown to filter the results according to what the user clicked.

View solution in original post

VatsalJagani
Super Champion

@aditsss - As @ITWhisperer  suggested it depends on what exactly you are trying to achieve but here is one thing which you might be interested in. You could tweak this slightly to achieve whatever you want.

Update Panel-1 Drilldown

<drilldown>
<set token="show">true</set>
<set token="selected_time">$click.value$</set>
<set token="selected_app_name">$click.value$</set>
</drilldown>

 

Update panel-2's query like this:

<query>index=abc ns=blazepsfpublish CASE(ERROR) app_name=$selected_app|s$ | bin span=1d _time | search _time=$selected_time$ | rex field=_raw "(?&lt;!LogLevel=)ERROR(?&lt;Error_Message&gt;.*)"</query>

Not sure if you really need the last rex part or not. But important part here is "app_name=$selected_app|s$ | bin span=1d _time | search _time=$selected_time$"

 

I hope this helps!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to do here

Your first query has a timechart span=1d by app_name, therefore you will have bars for each day for each app.

When you click on a bar, you will have a number of tokens available in the drilldown to indicate where on the chart the user clicked: $click.value$ (as you have used in your example) will contain the value of the day the user clicked; $click.name2$ will contain the name of the series i.e. the app_name.

You can use these to set tokens to pass to your second query.

Your second query also has a timechart command, so it is not going to show the raw events. You should determine what the search for the second panel needs to look like to show the data you want, then use the tokens from the drilldown to filter the results according to what the user clicked.

Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...