I want to use drilldowns on a "Network Diagram Viz" custom visualization in a dashboard. I want to show / hide panels depending on whether a node or a link has been clicked in the graph. So I finally...
See more...
I want to use drilldowns on a "Network Diagram Viz" custom visualization in a dashboard. I want to show / hide panels depending on whether a node or a link has been clicked in the graph. So I finally need two tokens, $is_node$ and $is_link$, to drive my <panel depends=...> clauses. I tried various ideas with no success so far, and most of them seem rather clumsy for the small task. Attempt 1: Splunk Drilldowns -> $row.<fieldname>$: "Available fields depend on whether a node or link was double clicked: Double clicking nodes: row.from, row.value, row.type, row.color Double clicking links: row.from, row.to, row.linkColor, row.linkText, row.linkWidth" Problem: When clicking first a link and then a node, the link-related variables are not reset, so testing for isnull(row.to) does not help much. Attempt 2: Same approach, but using the visualization's own token, $nd_to_node_token$ "Node (to): The 'to' field of the selected link. Defaults to $nd_to_node_token$" Same problem as above. When clicking a node, it retains the value of a previously clicked link. Attempt 3: Using $click.value$ or $nd_value_token$ "Node or link text: The label value of the selected node, or the linktext of the selected link. Defaults to $nd_value_token$." Luckily, the "value" of my nodes is always a MAC address and "linktext" of my links is always a 1- or 2-digit number (datatype string). So I can use regular expressions to determine what is clicked. I tried: <drilldown>
<eval token="click_type">if(match($nd_value_token$, "^[0-9]{1,2}$"), "is_link", "is_node")</eval>
</drilldown> ... It works, but this only gives me one token ($click_type$) with two possible values, but I need above mentioned two separate tokens. I also tried (following this question <panel>
<viz type="network-diagram-viz.network-diagram-viz">
<search>...</search>
<drilldown>
<condition match="match($click.value$, "^\d{1,2}$")">
<set token="is_link">true</set>
<unset token="is_node"></unset>
</condition>
<condition match="WHAT_TO_PUT_HERE?">
<unset token="is_link"></unset>
<set token="is_node">true</set>
</condition>
</drilldown>
</viz>
</panel> ... but I wouldn't know how to specify the match=... clause in the else branch. And I doubt that using match() in the match=... clause works at all. If I try this, clicking anywhere in the Network Diagram Viz takes me to a Splunk Search page - obviously something's wrong. Any ideas?