I am relatively new to all things splunk.
I am trying to set up a timechart that will pass a value onto another input. I can pass through $click.value$ fine along with $click.value2$. However in a time chart, that passes either the date or the count. I want it to send through the data sitting in the legend.
<drilldown>
<set token="form.Address1">$click.value$</set>
<set token="Address1">$click.value$</set>
</drilldown>
What can I use instead of $click.value$?
EDIT: More clarification. I am tracking the use of IP addresses. I have a search (see below) that will timechart which IP address performed a particular search over time.
...|timechart count by IPAddress
I then would like to pass through via drilldown which IP address I clicked on.
$click.value$ passes through the date(x axis). $click.value2$ passes through the count (y axis). How do I pass through the IP address instead?
Screenshot showing more what I want to passthrough:
-I do not have enough Karma to attach an image-
Pretty much, when you click on a colored line in the timechart, I want to pass through (via drilldown) the data in the legend (in this case the IP address).
$click.name2$ is what I needed.
$click.name$ passes through _time where $click.name2$ passes through the data sitting on the legend for what you clicked on (however it does NOT work when you actually click on the legend).
More information here:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/PanelreferenceforSimplifiedXML#chart_.28event_...
$click.name2$ is what I needed.
$click.name$ passes through _time where $click.name2$ passes through the data sitting on the legend for what you clicked on (however it does NOT work when you actually click on the legend).
More information here:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/PanelreferenceforSimplifiedXML#chart_.28event_...
Need more clarification... your query, sample output and what you want pass would help us to provide the answer correctly.
Sorry mate. I edited the question for a bit more info. Thanks.