The use case is this: I have a dashboard with a chart on it that shows the count of soap Faults for various Services over 4 hourly Time Buckets. The chart is shown as a line graph with a separate line for each Service (fault counts on Y-axis, time bucket on the X-axis). I'd like to click on a "cell" and bring-up a table showing the count of faults broken-out by FaultCode for the Service and Time Bucket where I clicked. So, the table will only be for a single Service and a single time bucket, but will show the count for each FaultCode for that Service in that time bucket. Using the "click.value" and "click.value2" facilities, I can only pass the count of faults - I cannot find a way to pass the Service name to the drill-down search. Intentions do not seem able to pass information from the legend to the drill-down search; but I cannot find any other way to do this either.
Any and all pointers are welcomed.
After a little thought... I suppose this would be challenging where the lines overlap; it would be difficult for Splunk to know which Service to show in the drill-down table. Perhaps access via the legend will do.
I see how to use click.value and click.value2 to get the X and Y values from a chart, but I don't see a way to pass the value I click on the legend to a drill-down table. Does anyone know a way to do that?
Looks like the "drill-down from legend" is supposed to be built-in; but when I click on a dashboard chart that I build with the "simple" XML, then converted to the "advanced XML", this feature does not work. Instead, I get some error messages:
(1) "Encountered an unexpected error while parsing intentions."
(2) "PARSER: Applying intentions failed Drilldown error: unable to drill down on legend 'NetworkService'"
Below is the chunk of XML for that chart; there are no declared intentions, but I don't know how to do that for the legend (cannot find anything in the docs for that).
When I try the "legend click" on an older version that has not been converted to the "advanced XML", it also fails in the same way; so, perhaps the conversion has nothing to do with this problem. Meanwhile another very similar chart allows the automatic legend-click drill-down with no errors; this seems broken.
<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Hourly Fault Count for Selected Services" autoRun="True">
<param name="savedSearch">Hourly Fault Count for Selected Services</param>
<param name="groupLabel">Hourly Fault Count for Selected Services</param>
<module name="ViewstateAdapter">
<param name="savedSearch">Hourly Fault Count for Selected Services</param>
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<module name="FlashChart">
<param name="width">100%</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
... View more
