There a few questions in regards to the Interactions for Dashboard studios. This is the current code I have: { "drilldown": "true", "visualizations": { "viz_ar3dmyq9": { ...
See more...
There a few questions in regards to the Interactions for Dashboard studios. This is the current code I have: { "drilldown": "true", "visualizations": { "viz_ar3dmyq9": { "type": "splunk.line", "dataSources": { "primary": "ds_jjp4wUrz" }, "eventHandlers": [ { "type": "drilldown.setToken", "options": { "tokens": [ { "token": "click_time", "key": "row._time.value" } ] } }, { "type": "drilldown.linkToSearch", "options": { "query": "SomeSearchQuery", "earliest": "$click_time$", "latest": "$global_time.latest$", "type": "custom", "newTab": true } } ], "options": { "seriesColorsByField": {}, "dataValuesDisplay": "minmax", "y2AxisTitleText": "" } }, "viz_leeY0Yzv": { "type": "splunk.markdown", "options": { "markdown": "**Value of Clicked row : $click_time$**", "backgroundColor": "#ffffff", "fontFamily": "Times New Roman", "fontSize": "extraLarge" } } }, "dataSources": { "ds_uHpCvdwq": { "type": "ds.search", "options": { "enableSmartSources": true, "query": "someCustomQuery", "refresh": "10s", "refreshType": "delay" }, "name": "CustomQuery" }, "ds_jjp4wUrz": { "type": "ds.search", "options": { "query": "AnotherCustomQuery", "refresh": "10s", "refreshType": "delay" }, "name": "CustomQuery2" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-60m@m,now" }, "title": "Global Time Range" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "viz_ar3dmyq9", "type": "block", "position": { "x": 0, "y": 0, "w": 1440, "h": 330 } }, { "item": "viz_leeY0Yzv", "type": "block", "position": { "x": 310, "y": 780, "w": 940, "h": 30 } } ], "globalInputs": [ "input_global_trp" ] }, "description": "Tracking objects", "title": "Info" } The line chart maps the data from 'AnotherCustomQuery' (ds_jjp4wUrz), which is a query returning a chart that gets the max object_times for the 3 objects at one minute intervals: .... | chart span=1m max(object_time) OVER _time by object Producing a 3 line chart, each line representing each object. I can get the time the user clicked on, tokenized in "click_time", but a few puzzles remain: 1. When the user clicks on a object line, how do I get the line's object_name and pass it along to my search query? 2. For the "drilldown.linkToSearch", how can I add 1 minute to the click_time and add it into the latest? Is it possible I don't need that range and search at a specific time? 3. When I open the dashboard, the first click search says "invalid earliest time", but subsequent clicks on the chart says it's working fine. Is there are particular reason why this is happening?