Help with timechart drilldown without by clause

[jip31]

hello

I timechart events without a by clause

| timechart count(crash) as "crash" count(hang) as "hang"

When I click on "cras" or "hang" I need to open a drilldown not in another dashboard but with ajust in a new window

I trie with a token or with a link to the search but it doesnt works

Could you help please?

[ITWhisperer]

What do you mean by "not in another dashboard"?

What do you mean by a "new window"?

What have you tried?

[jip31]

it means that I dont want to create a new dash just for this drilldown

I want to use a token or a personalized link to the search

I tried this :

$click.value$=crash OR $click.value$=hang

[ITWhisperer]

Try 

$click.name2$="crash"

or

$click.name2$="hang"

[jip31]

`index` sourcetype=tutu $click.name2$='crash_process' OR $click.name2$='hang_process' 
| timechart count(crash_process) as "Crash" count(hang_process) as "Hang"

[ITWhisperer]

$click.name2$ and other $click.xxx$ tokens are available in the drilldown not the search.

Where is your drilldown SimpleXML code?

[jip31]

   <drilldown>
          <link target="_blank">search?q=%60index%60%20source%3Dstandalone%20sourcetype%3Dez%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20search%20$click.name$%3D'Crash'&amp;earliest=$periode.earliest$&amp;latest=$periode.latest$</link>
        </drilldown>

[ITWhisperer]

Try it like this

   <drilldown>
          <link target="_blank">search?q=%60index%60%20source%3Dstandalone%20sourcetype%3Dez%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20search%20$click.name2$&amp;earliest=$periode.earliest$&amp;latest=$periode.latest$</link>
        </drilldown>

[jip31]

always no results

here is the updated xml

    <drilldown>
          <link target="_blank">search?q=%60index_mesurescontinues%60%20(sourcetype%3Dezoptima%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang)%20source%3Dstandalone%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20search%20$click.name2$&amp;earliest=$periode.earliest$&amp;latest=$periode.latest$</link>
        </drilldown>

[ITWhisperer]

OK I am guessing you want to search for the value that was clicked?

    <drilldown>
          <link target="_blank">search?q=%60index_mesurescontinues%60%20(sourcetype%3Dezoptima%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang)%20source%3Dstandalone%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20search%20$click.value2$&amp;earliest=$periode.earliest$&amp;latest=$periode.latest$</link>
        </drilldown>

[jip31]

exactly

[ITWhisperer]

The previous search would have just searched for the value clicked after the drilldown search has executed. This value would have come from the search used for the panel, which doesn't necessarily have to be the same.

If it is still not giving you want you want, for a complete picture (which is always helpful), can you share both the panel search and the drilldown search?

[jip31]

sorry but i dont understand everything

here is my timechart

what I need is :

1) to display the detail of crash and the detail of hang after clicking on crash bar chart or hang bar chart

OR

2) to display both crash and hang after clicking on time serie, for example, if I click on 14:00 time serie, I want to display crash and hang corresponding to this time serie

For the moment the drilldown search is the same than the panel search because I just try to pass the token from the panel search (it means that if I click on crash, I just display crash in the drilldown timechart and if I click on hang I just display hang on the timechart)

[ITWhisperer · Accepted solution]

Try something like this

    <drilldown>
        <condition match="isnotnull($click.value$)">
          <eval token="periodend">$click.value$+600</eval>
          <link target="_blank">search?q=%60index_mesurescontinues%60%20(sourcetype%3Dezoptima%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang)%20source%3Dstandalone%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22&amp;earliest=$click.value$&amp;latest=$periodend$</link>
        </condition>
        <condition>
          <link target="_blank">search?q=%60index_mesurescontinues%60%20(sourcetype%3Dezoptima%3Acrash%20OR%20sourcetype%3Dezoptima%3Ahang)%20source%3Dstandalone%20ezconf%3D$ezconf$%20host%3D$host$%20sam%3D$sam$%20%0A%7C%20fields%20crash_process%20hang_process%0A%7C%20timechart%20count(crash_process)%20as%20%22Crash%22%20count(hang_process)%20as%20%22Hang%22%7C%20fields%20_time%20$click.name2$&amp;earliest=$periode.earliest$&amp;latest=$periode.latest$</link>
        </condition>
      </drilldown>

[jip31]

it works for the serie below (both hang and crash)

but not for this one

[ITWhisperer]

Sorry, I should have said, to get a chart for a single series, click on the legend; for a time period, click on either bar in the time period

[jip31]

ok thanks

[jip31]

it doesnt works

[ITWhisperer]

Please share your code so we might be able to see what is wrong - just saying "It doesnt work" doesn't help us help you!