Trying to click on an item in the legend and have a new search come up based on item clicked.
Here is my current working code that I am trying to expand:
<view template="dashboard.html">
<label>foo123</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Stolen CPU time per pool" autoRun="True">
<param name="search">index=unix dom0stat42 | sort _time | timechart span="1m" avg(steal_time) by pool limit=0</param>
<param name="groupLabel">Stolen CPU time per pool</param>
<param name="earliest">-30m</param>
<param name="latest">-0m</param>
<module name="ViewstateAdapter">
<module name="HiddenFieldPicker">
<param name="strictMode">False</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.chart">line</param>
<param name="charting.secondaryAxisTitle.text">Stolen CPU time as %</param>
<param name="charting.legend.placement">left</param>
<param name="charting.primaryAxisTitle.text">Time</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">250px</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>
I have been trying to follow the Splunk docs guide:
http://docs.splunk.com/Documentation/Splunk/latest/Developer/TableChartDrilldown
I would like to have it launch a new search when clicked:
index=unix dom0stat42 pool=$click.value$ | sort _time | timechart span="1m" avg(steal_time) by pool limit=0
I can get the new search to launch, and the search string to come up, but I am still stuck on getting $click.value$ to work.
Any ideas?
I got it:
<view template="dashboard.html">
<label>OVM pool level stolen CPU time</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Stolen CPU time per pool" autoRun="True">
group="Test Flashchart" autoRun="True">
<param name="search">index=unix dom0stat42 | timechart span="1m" max(steal_time) by pool limit=0</param>
<param name="earliest">-1h</param>
<param name="latest">-0m</param>
<module name="ResultsHeader">
<param name="entityName">scanned</param>
<param name="entityLabel">data points</param>
<module name="JobProgressIndicator">
<module name="HiddenChartFormatter">
<param name="charting.chart">line</param>
<param name="charting.secondaryAxisTitle.text">Stolen CPU time as %</param>
<param name="charting.legend.placement">left</param>
<param name="charting.primaryAxisTitle.text">Time</param>
<param name="charting.chart.nullValueMode">connect</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">250px</param>
<module name="HiddenSearch">
<param name="search">index=unix dom0stat42 | timechart span="1m" avg(steal_time) by host limit=0</param>
<param name="earliest">-1h</param>
<param name="latest">-0m</param>
<module name="ConvertToIntention">
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="pool">$click.name2$</param>
</param>
</param>
<module name="JobProgressIndicator"></module>
<module name="SimpleResultsHeader">
<param name="entityName">results</param>
<!--param name="headerFormat">$click.name2$=$click.value2$</param-->
<param name="headerFormat">$click.name2$ Stolen CPU time</param>
</module>
<module name="HiddenChartFormatter">
<param name="charting.chart">line</param>
<param name="charting.primaryAxisTitle.text">Time</param>
<param name="charting.secondaryAxisTitle.text">Stolen CPU time as %</param>
<param name="charting.legend.placement">left</param>
<param name="charting.chart.nullValueMode">connect</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">250px</param>
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>