Splunk Search

Why is the condition tag in my in-page drilldown not working for chart overlay?

chitra
Explorer

Implemented chart overlay and trying in-page drilldown based on field condition.
I want to set queries for token based on field.

For example:
<drilldown>
<condition field="host">
<set token="query">index=_internal | table host</set>
</condition>
<condition field="sourcetype">
<set token="query">index=_internal | table sourcetype</set>
</condition>

Currently implemented like above code, but on click of the chart, it's going to the search bar instead of the expected drilldown. Kindly let me know Is there any other way to implement an in-page drilldown for a chart overlay?

Tags (3)

JoshWhaley
Path Finder

After a lot of searching, I found that my issue was caused by the assumption that the click's provided field would be equal to $click.name$ like many other modules, but as I found here, the field is equal to the y-axis (equal to $click.name2).
If your issue is similar to mine, changing the field=""line should resolve the issue.

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

I'm looking at this documentation for reference:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Understandbasictableandchartdrilldownactions#C...

It seems that there might be an issue with the syntax that you're using to indicate that the "query" token should take the search result as its value. I believe the issue has to do with the current setup causing the search to run on the click event (hence the transfer over to the search bar), rather than using fields, the condition tag, and tokens to pass the data about where the user is clicking to the search.

This example in particular seems similar to what you're trying to do, though it does not include overlay:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Understandbasictableandchartdrilldownactions#C...

Take a look at the click event and search handling in the example above and let me know if this works! If not, we can keep troubleshooting.

All best,
@frobinson_splunk

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hello @JoshWhaley and @chitra,
I am a tech writer here at Splunk. I work on documentation for charting and drilldowns. I'd like to help with your question. I'm going to look into this one with our engineers and I'll report back with some information. Please stay tuned!

All best,
@frobinson_splunk

0 Karma

JoshWhaley
Path Finder

Also having this issue.. Do charts not support the condition tag within drilldown?

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...