Splunk Search

How to create a timechart that drills down to a table with relevant data when I click a data point or select a time range in the chart?

wencheng199999
Explorer

How to add a click and selection event to a timechart like using Javascript in Web Development?
Is there anyone who knows which demo I can follow or docs easy to understand? Thanks!

0 Karma

niketn
Legend

Just before the timechart command have a table command to print the required values like

<your base search> | table _time, id, status | timechart span=1h count(id) as Count by status

This way when you click on timechart the drilldown will search for the required details in table. If you click on any event detail in the table it will drill down to the raw event.

Edited to add tokens available on Zooming in a timechart

Since you want to Drill Down the details of Selection made in chart when it is zoomed in you would need to code the selection event in the Simple XML. Following code from the timechart will extract the epoch start time and end time from the selection. Refer to Pan and Zoom chart Controls example in the Splunk 6.x Dashboard Examples App for details

        <selection>
            <set token="selection.earliest">$start$</set>
            <set token="selection.latest">$end$</set>
            <set token="start.count">$start.count$</set>
            <set token="end.count">$end.count$</set>
        </selection>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

wencheng199999
Explorer

@niketnilay Thanks. I've tried your suggestion in my query. And it work that when i click the point it will redirect me to another page with a new search. But when i drag and select multi points in chart, it only zoom the chart. So, my real need is that the table show events queried according to the time of the point clicked or the time range of the points selected by drag.

0 Karma

niketn
Legend

Since you want tokens to be available after zooming in a chart, I have edited my answer for the same. Please refer to Splunk 6.x Dashboard Examples App if you need more details or complete example.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sundareshr
Legend

See if this online doc gets you started

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens

0 Karma

wencheng199999
Explorer

@sundareshr Thank you for answer my question and give me support again. I've glance over the token. And it was like programming language variables. My difficulty is that i don't know how to response to a "click" or "select" in timechart? It means when i click in the chart, a table should display under the chart. The table show the information of the point clicked by me in chart .

0 Karma

sundareshr
Legend

See if this helps, if not, share your queries for both the timechart as well as the resulting table.

https://answers.splunk.com/answers/150980/how-to-make-column-timechart-that-can-drill-down-to-the-cl...

0 Karma

wencheng199999
Explorer

@sundareshr Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...