Splunk Search

Why is the condition tag in my in-page drilldown not working for chart overlay?

chitra
Explorer

Implemented chart overlay and trying in-page drilldown based on field condition.
I want to set queries for token based on field.

For example:
<drilldown>
<condition field="host">
<set token="query">index=_internal | table host</set>
</condition>
<condition field="sourcetype">
<set token="query">index=_internal | table sourcetype</set>
</condition>

Currently implemented like above code, but on click of the chart, it's going to the search bar instead of the expected drilldown. Kindly let me know Is there any other way to implement an in-page drilldown for a chart overlay?

Tags (3)

JoshWhaley
Path Finder

After a lot of searching, I found that my issue was caused by the assumption that the click's provided field would be equal to $click.name$ like many other modules, but as I found here, the field is equal to the y-axis (equal to $click.name2).
If your issue is similar to mine, changing the field=""line should resolve the issue.

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

I'm looking at this documentation for reference:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Understandbasictableandchartdrilldownactions#C...

It seems that there might be an issue with the syntax that you're using to indicate that the "query" token should take the search result as its value. I believe the issue has to do with the current setup causing the search to run on the click event (hence the transfer over to the search bar), rather than using fields, the condition tag, and tokens to pass the data about where the user is clicking to the search.

This example in particular seems similar to what you're trying to do, though it does not include overlay:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Understandbasictableandchartdrilldownactions#C...

Take a look at the click event and search handling in the example above and let me know if this works! If not, we can keep troubleshooting.

All best,
@frobinson_splunk

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hello @JoshWhaley and @chitra,
I am a tech writer here at Splunk. I work on documentation for charting and drilldowns. I'd like to help with your question. I'm going to look into this one with our engineers and I'll report back with some information. Please stay tuned!

All best,
@frobinson_splunk

0 Karma

JoshWhaley
Path Finder

Also having this issue.. Do charts not support the condition tag within drilldown?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...