Splunk Search

How to capture Y-axis value for drill down in column chart?

viswanathsd
Path Finder

fieldname="$row.$" with and without quotes both are not working.
Fields values were renamed .Tried with both the values still didn't capturing the value.

Tags (2)
0 Karma
1 Solution

jayannah
Builder

chart (event tokens):
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The clicked field name is the name of the field or series for the y-Axis if present (similar to click.name2). If the name of the field or series is not available the field or category for the x-axis is used (click.name).

Data Property Description
click.name Name of the field or category for the x-axis. Not available when the legend has been clicked.
click.value Value of the field or category for the x-axis. Not available when the legend has been clicked.
click.name2 Name of the field or series for the y-axis.
click.value2 Value of the field or series for the y-axis. Not available when the legend has been clicked.
row. Any field values along the y-axis at the same point as the click on the x-axis. Not available when the legend has been clicked.
row. Value of the x-axis. Not available when the legend has been clicked.
earliest/latest Time range of the clicked chart segment, or if not applicable, the time range of the search.

For more details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/PanelreferenceforSimplifiedXML

View solution in original post

jayannah
Builder

chart (event tokens):
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The clicked field name is the name of the field or series for the y-Axis if present (similar to click.name2). If the name of the field or series is not available the field or category for the x-axis is used (click.name).

Data Property Description
click.name Name of the field or category for the x-axis. Not available when the legend has been clicked.
click.value Value of the field or category for the x-axis. Not available when the legend has been clicked.
click.name2 Name of the field or series for the y-axis.
click.value2 Value of the field or series for the y-axis. Not available when the legend has been clicked.
row. Any field values along the y-axis at the same point as the click on the x-axis. Not available when the legend has been clicked.
row. Value of the x-axis. Not available when the legend has been clicked.
earliest/latest Time range of the clicked chart segment, or if not applicable, the time range of the search.

For more details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/PanelreferenceforSimplifiedXML

helenashton
Path Finder

I think all you are missing is putting the column heading in, i.e. $row.host$ (or whatever).

If it isn't this, then are you using simple or advanced XML? Can you share the appropriate part of the XML?

0 Karma

viswanathsd
Path Finder

No,it will populate and used for x axis values,it worked fine.

0 Karma

viswanathsd
Path Finder

abc_xxx_summary.transaction_name field value is not caturing when I clicked

    <link>
      <![CDATA[

            /app/on_b/search?q=search%20index%3Donb%20sourcetype%3Depfapp%20OnB-*%20abc_xxx_summary.transaction_name%3D"$row.abc_xxx_summary.transaction_name$"%20%7Cbucket%20span%3D1m%20_time%7Cchart%20count%20as%20Errors%20OVER%20_time&earliest=&latest=&display.general.type=statistics
                                ]]>
    </link>      
 </drilldown>
0 Karma

helenashton
Path Finder

Am I right in assuming when you click on the link you see "$row.abc_xxx_summary.transaction_name$" in the actual link opened?
If so, I think the problem is that you are using CDATA and that the tokens might not be populated inside this. Can you check?

0 Karma

viswanathsd
Path Finder

Thanks for the response.
It was typo,I used $row.fieldname$ and using simple xml.

0 Karma

helenashton
Path Finder

So can you share the XML - it should help us work out the problem?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...