Splunk Search

How to make column timechart that can drill down to the clicked column time value?

pepper_seattle
Path Finder

Hi,

I've got a timechart which lays out the average response count for multiple groups over the last hour with a column display.

Code example:

index=*text* sourcetype=*text* groupid=* | timechart span=1m avg(response)

....
....
<drilldown>
<set token="group_tok">$click.value$</set>
</drilldown>

I want to have a drilldown that produces multiple views on the same page when one of these columns is clicked. The only catch being that the views displayed should be for the time the column appears for, ex: clicking the column for August 14th 1:00pm results in a view with only data from that date and minute of time (given that each column is a minute of data). My code allows these columns to be clicked using a , but it won't keep to that exact minute, instead giving me something from the last hour or so.

Essentially, how would I make a column timechart that can be drilled down to the clicked time?

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Check out http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/PanelreferenceforSimplifiedXML#chart_.28event_... - your chart produces $earliest$ and $latest$ tokens. Use those to set global tokens like this:

<drilldown>
  <set token="clicked_earliest">$earliest$</set>
  <set token="clicked_latest">$latest$</set>
  <set token="clicked_group">$click.name2$</set>
</drilldown>

Then use those tokens to set the time range of your drilldown searches.

View solution in original post

pal_sumit1
Path Finder

I am also trying the same but instead of getting the earliest and latest time of particular column in timechart , I am getting time of the search, Please help.

      <query> 
 | timechart span=$range$ avg(WAIVER_OPEN_CASES) as OPEN_CASES, avg(NON_COMPLIANT_TWO_OR_MORE_METHODS) as NON_COMPLIANT_TWO_OR_MORE_METHODS </query>
    </search>

and after this chart commands and drilldown you mentioned.

0 Karma

ngohel
Engager

Excellent answer. It worked in my case. Thanks for sharing

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Check out http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/PanelreferenceforSimplifiedXML#chart_.28event_... - your chart produces $earliest$ and $latest$ tokens. Use those to set global tokens like this:

<drilldown>
  <set token="clicked_earliest">$earliest$</set>
  <set token="clicked_latest">$latest$</set>
  <set token="clicked_group">$click.name2$</set>
</drilldown>

Then use those tokens to set the time range of your drilldown searches.

View solution in original post

james_n
Path Finder

Hi @martin_mueller , I have a similar question, could you please help on this,

i have query like | timechart count by status.
output: _time status
1/1/2018 20:10:12.214 2
10/1/2018 12:32:45.153 4

when i click on bar chart legend, _time should pass to another chart date, hour and minutes only like 1/1/2018 20:10.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Ask a new question in order to ask a new question.

0 Karma

pepper_seattle
Path Finder

This worked, thanks for all the help!

0 Karma

somesoni2
Revered Legend

See the different tokens available on click event for drilldown.

http://docs.splunk.com/Documentation/Splunk/6.1/Viz/PanelreferenceforSimplifiedXML#Drilldown_event_t...

My suggestion will be rename avg(response) as avgResponse and then create two tokens for _time and avgResponse as $row._time$ and $row.avgResponse$. Then use the $row._time$ token to determine the earliest and latest for the subsequent panels.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.