creating a drilldown using the span from the from the source dashboard

[jvmerilla]

Hi,

I have a chart with this query:

index="sample_data" sourcetype="analytics_sampledata.csv" Status="*" "Ticket Type"="*" Priority="*"
| fields *
| rename "Reported_Assigned Date" as Reported_Assigned_Date
| eval _time = strptime(Reported_Assigned_Date, "%m/%d/%Y") | rename "Application Name" as Application
| timechart span=1mon count by Application

This is the visualization:

The span here is dynamic. It is being set by a "drop-down input"

What I want to happen is that to pass this span to the drilldown so that I the result I will get in the drilldown is only the data within that time span.

How will I do this?

[mayurr98]

hey @jvmerilla

Use this ready-made XML create a dashboard and simply put this XML: which has span and time picker as the input filter.
edit the dashboard add some more span according to your need.

<form>
  <label>test</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>Timepicker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="span">
      <label>span</label>
      <choice value="5m">5 minutes</choice>
      <choice value="15m">15 minutes</choice>
      <choice value="30m">30 minutes</choice>
      <choice value="1mon">1 month</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index="sample_data" sourcetype="analytics_sampledata.csv" Status="*" "Ticket Type"="*" Priority="*" | fields * | rename "Reported_Assigned Date" as Reported_Assigned_Date | eval _time = strptime(Reported_Assigned_Date, "%m/%d/%Y") | rename "Application Name" as Application | timechart span=$span$ count by Application</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link>
            <![CDATA[
         /app/search/test2?form.test2token=$field2$
         ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

Let me know if it helps you!

[nikita_p]

Hi @jvmerilla,
Please check expected answer in the below link if it works for you.
https://answers.splunk.com/answers/230345/how-can-i-drill-down-from-one-panel-pie-chart-to-a.html

[harsmarvania57]

Hi @jvmerilla,

I have created sample dashboard, please find below XML in which I am supplying span value from drop-down and after that while clicking on any column it is passing span value (which I am passing from dropdown as field2 token) to another dashboard using drilldown.

<form>
  <label>test</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="multiselect" token="field1" searchWhenChanged="false">
      <label>field1</label>
      <choice value="sourcetype">Sourcetype</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> </delimiter>
    </input>
    <input type="dropdown" token="field2">
      <label>field2</label>
      <choice value="5m">5 min</choice>
      <choice value="15m">15 min</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal | timechart span=$field2$ count by $field1$ </query>
          <earliest>-120m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <link>
            <![CDATA[
        /app/search/test2?form.test2token=$field2$
        ]]>
          </link>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

I hope this helps.

Thanks,
Harshil