Splunk Search

Can i display panel with Even or Odd Click on chart ?

akira2211
Explorer

Hi all,

Can i display left and right panel based on Even or Odd Click ?

For example,

I have a chart. And a row with title is "Comparison" including left panel and right panel.

So, my question is for even click(0,2,4,...) the left panel will be changed and the right panel was changed with odd click (1,3,5,...)

Example code,

 

 

<row>
	<panel depends="$ver$">
		<title>Here is the chart</title>
			<chart>
				<search>
					<query>index=idx MODEL IN ($model$) LOCAL=$location$ source="*"
					| dedup VERSION sortby -TOTALSIZE 
					| chart values(TOTALSIZE) by VERSION
					</query>
	        <earliest>$time.earliest$</earliest>
	        <latest>$time.latest$</latest>
	      </search>
	      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
	      <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
	      <option name="charting.axisY.abbreviation">none</option>
	      <option name="charting.chart">column</option>
	      <option name="charting.chart.showDataLabels">minmax</option>
	      <option name="charting.chart.stackMode">default</option>
	      <option name="charting.drilldown">all</option>
	      <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
	      <option name="height">600</option>
	      <option name="refresh.display">progressbar</option>
	        
	      <drilldown>
	          <set token="version">$row.VERSION$</set>
	      </drilldown>
	        
	    </chart>
	</panel>
</row>
<row>
	<panel depends="$version$">
		<title>LEFT PANEL</title>
		<table>
			<search>
          <query>index=flash MODEL IN ($model$) LOCAL=$location source="*"
      | search VERSION&lt;$odd_click_verion$ 
      | stats count by VERSION 
      | sort -VERSION</query>
    	</search>
		</table>

	</panel>
	
	<panel depends="$version$">
		<title>RIGHT PANEL</title>
		<table>
			<search>
          <query>index=flash MODEL IN ($model$) LOCAL=$location source="*"
      | search VERSION&lt;$even_click_verion$ 
      | stats count by VERSION 
      | sort -VERSION</query>
    	</search>
		</table>
	</panel>
</row>

 

 

 appreciate for any help & comment 

 

Labels (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Thinking out loud, but this could be done easily if the first chart was a <table> and you could number the rows with

 

| eval row=1
| accum row

 

and in the drilldown have

 

<drilldown>
  <eval token="even_click_version">if($row.row$%2=0,$row.row$,$even_click_version$)</eval>
  <eval token="odd_click_version">if($row.row$%2=1,$row.row$,$odd_click_version$)</eval>
</drilldown>

 

 

The full example,  but with searches that work in my data 

 

  <row>
    <panel>
      <title>Here is the chart</title>
      <table>
        <search>
          <query>index=location 
| chart values(tid) as v by type
| eval row=1
| accum row
          </query>
          <earliest>$time_range.earliest$</earliest>
          <latest>$time_range.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <eval token="even_click_version">if($row.row$%2=0,$row.type$,$even_click_version$)</eval>
          <eval token="odd_click_version">if($row.row$%2=1,$row.type$,$odd_click_version$)</eval>
          <set token="type">$row.type$</set>
        </drilldown>
        <fields>"type","v"</fields>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$type$">
      <title>LEFT PANEL</title>
      <table>
        <search>
          <query>index=location type=$even_click_version$
            | table type lat lon</query>
          <earliest>$time_range.earliest$</earliest>
          <latest>$time_range.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$type$">
      <title>RIGHT PANEL</title>
      <table>
        <search>
          <query>index=location type=$odd_click_version$
            | table type lat lon</query>
          <earliest>$time_range.earliest$</earliest>
          <latest>$time_range.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>

 

Problem is that <chart> does not support <fields> so you can't hide the row value used for the drilldown.

What you could do using the above principle, is to, for example, add the row to the version, with something like

 

| eval row=1
| accum row
| eval version=version."/".row

and then in the drilldown eval do

          <eval token="even_click_version">if(tonumber(replace($row.version$,".*/(\d+)","\1"))%2=0,tonumber(replace($row.version$,".*/(\d+)","\1")),$even_click_version$)</eval>
          <eval token="odd_click_version">if(tonumber(replace($row.version$,".*/(\d+)","\1"))%2=0,tonumber(replace($row.version$,".*/(\d+)","\1")),$odd_click_version$)</eval>

although I didn't manage to make that work, it _should_ be possible to eval that out

 

0 Karma

akira2211
Explorer

Thanks bowesmana, your reply really helpful. But I want display by click on the chart, it will be more convenient for user than table. 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Sure, I wasn't suggested you use a table, just pointing out Splunk ways to achieve what you were trying to do

0 Karma

akira2211
Explorer

Anyone help please, should  I add an JS to counter this issue or xml have any function support that?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...