Dashboards & Visualizations

pass more than one value to drill down chart

spatil
Path Finder

Hi ,

I have a drill down chart , which is getting filtered as per value clicked by user. Using below xml for the same.

<module name="ConvertToIntention">
  <param name="intention">
    <param name="name">addterm</param>
    <param name="arg">
    <param name="host">$click.value$</param>
    </param>
  </param>

Now, I need to filter drill down chart using both $click.value$ as well as selected value from drop down field. I can get selected value from drop down using $percentage$. How can I use this $percentage$ to filter the drill down chart ?

regards, S.

Tags (1)

Ant1D
Motivator
<module name="HiddenSearch"  autoRun="True">
    <!--search template for drill down chart-->
    <param name="search">index="myindex" |  timechart max(Usage_MB) by mount_points</param>
<module name="ConvertToIntention">
    <param name="settingToConvert">percentage_setting</param>
    <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
             <param name="percentageUsage">
                 <param name="fillOnEmpty">True</param>
                 <param name="value">$target$</param>
             </param>
        </param>
    </param>
    <module name="ConvertToIntention">
        <param name="intention">
             <param name="name">addterm</param>
             <param name="arg">
                  <param name="host">$click.value$</param>
             </param>
        </param>
      ...charting tags for drill down chart
    </module> <!-- end of ConvertToIntention-->
</module> <!-- end of ConvertToIntention-->

Maybe this is what you are looking for.

0 Karma

Ant1D
Motivator

Hi, I have tweaked the code. Where it says param name=value, I have changed the value from $percentage$ to $target$. This might help.

0 Karma

spatil
Path Finder

thanks adaniel , but It is still not working. Now it is showing some results in drill down chart, but does not show any change when different percentage is selected from drop down.

0 Karma

Ant1D
Motivator

based on the code above, it should add host=chart_value_clicked and percentageUsage=the_field_for_percentages to your search index="myindex"...

0 Karma

Ant1D
Motivator

I have changed the code in my answer. Maybe it will help.

0 Karma

spatil
Path Finder

thanks for ur reply, I tried above xml , but it is not showing any result. showing "no result found"

0 Karma

spatil
Path Finder

I created new addterm intension using another ConvertToIntension module, still It is not filtering drill down chart for $percentage$

below is the part of xml for view

<module name="HiddenSearch"  autoRun="True">
    <!--search template for drill down chart-->
    <param name="search">index="myindex" |  timechart max(Usage_MB) by mount_points</param>
<module name="ConvertToIntention">
  <param name="intention">
  <param name="name">addterm</param>
  <param name="arg">
    <param name="host">$click.value$</param>
  </param>
  </param>
  <module name="ConvertToIntention">
  <param name="intention">
  <param name="name">addtermlt</param>
  <param name="arg">
    <param name="percentageUsage">$percentage$</param>
  </param>
  </param>
  ...charting tags for drill down chart
  </module> <!-- end of addterm $percentage$-->
  </module> <!-- end of addterm $click.value$-->
  ...
  </module> <!--end os hidden search for drill down chart-->

Can any one point out the mistake here ? regards, S.

0 Karma

sideview
SplunkTrust
SplunkTrust

You have to turn the $percentage$ into an intention, much like you turned $click.value$ into an addterm intention.

A) If you want the percentage to be a plain old searchterm like $click.value$ was, you can just use create another addterm intention (using another ConvertToIntention).

B) If you want it to turn into a searchterm like percentage>40, that would be the addtermgt intention. Likewise with the addtermlt intention. Mileage may vary as these dont get used very often.

C) If the percentage field is destined for something more complicated than becoming a simple searchterm, you'll have to use the 'stringreplace' intention. The UI Examples app on SplunkBase has some examples of stringreplace syntax, if you havent read through them already. And with the stringreplace intention has to get plugged into some 'search', so you also leave a little $percentage$ token in the search param of the HiddenSearch module.

Since you're using addterm, my guess is that you probably dont have a HiddenSearch module between the first FlashChart and the second; with addterm you generally dont need one. So you might need to insert one in there to capture the $percentage$.

D) If you happen to be using the modules in sideview_utils, the story there is similar but simpler. In that system the UI values like $percentage$ just plug in directly to a Search module and there's no intervening step where you have to convert anything to an intention.

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...