how to extract a change_link from _raw depending on the datapoint a user click on in a line graph?

[isplunk2999]

Hi
I insert the data in the following JSON format and create a linegraph over _time,each of the circle markers in the line graph represent the count field over _time ,what I am looking for is depending on the datapoint the user clicks on, I want to pull the URL from change_link.

How do I set a variable (url) based on what the user click on to extract the change_link and then use this variable in the link_target?

How do I pull the url from a nested json ?how to set a token based on what they clicked on and extract the change_link and then you use that token as your link_target?

Please advise

_raw = {
    "Analyze":{
        "P5":{"count":"","change_link":""}
    },
    "timestamp": int(time.time())  # Can also use datetime.datetime.now().isoformat()
} 

Following is my code
CODE:

<dashboard>
  <label>radar_trend_test_report</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=indexname  sourcetype=sourcetype | chart values(Analyze.P5.count) as P5  over _time</query>
          <earliest>@w0</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
        </drilldown>
      </chart>
    </panel>
  </row>
</dashboard>

[isplunk2999]

I tried as below but when I click on the circle marker I get Page not found! ,I need some guidance from here

<drilldown>
   <set token="url">| eval url=spath(_raw, "Analyze.P5.$click.value${}.change_link")</set>
   <link target="_blank">$url$</link>
</drilldown>

[niketn]

When the drilldown URL is constructed what should it look like. When you use chart command you drop raw data, what do you imply by url token that you are trying to set? Instead of creating a link, can you print the $url$ token in Splunk dashboard? Also what is the URL in the browser when you see "Page not found"?

[isplunk2999]

Hey @niketn :

Answers below

1.When the drilldown URL is constructed what should it look like?
[Answer] URL is already in change_link, we just need to take that , am trying to pull that.

2.When you use chart command you drop raw data, what do you imply by url token that you are trying to set?
[Answer]I am trying to set a variable (url) based on what the user click and to extract the change_link value from raw data. Then use this variable in the link_target,all I need is depending on the datapoint the user click on I want to pull the URL from change_link,if there are simpler ways to achieve it I am open to that.

3.Instead of creating a link, can you print the $url$ token in Splunk dashboard? Also what is the URL in the browser when you see "Page not found"?
[Answer]Please elaborate ,like I said above all I need is depending on the datapoint the user click on I want to pull the URL from change_link value from raw data ,if there are simpler ways to achieve it I am open to that.

[niketn]

@isplunk2999 as per the above code when you chart P5 counts you loose the value of URL hence can not do a drilldown to URL.

If however, this was a table you could have used <fields> attributed in the table to hide URL from being displayed and user could have clicked on P5 to drilldown through the hidden url field.

You can refer to Splunk Dashboard Examples app for this hidden url field in table for drilldown example. Please let us know if you need assistance with this.