Drilldown from Flashchart part 2 (Advanced)

[Ant1D]

Hey, I am aware that you can drilldown from a chart so that clicking on a cell will open a new view where another search that you have specified is run.

However:

If my flashchart has a number of different coloured cells (e.g. yellow = completed, blue = not_complete) How can I drill down on each cell so that clicking on blue runs a search index=a and clicking on yellow runs a search index=z?

Essentially, the search that is executed and the view that the user is redirected to is dependent on the colour of the cell in the chart that is clicked.

E.g. Clicking yellow could take me to a view named dashboard_completed_info and clicking blue could take me to a view named dashboard_issues

[sideview · Accepted solution]

Short version: This cannot be done in the core Splunk UI.

Long version: It can be done in two ways in the Splunk UI but they both are hacks and they both require understanding both the advanced XML and the module framework quite well:

a) attaching some relatively brittle Javascript behavior from application.js. There are two ways to do this but the main one is to have a NullModule in the view and then from application.js you redefine the class implementation of NullModule in that particular view to do whatever you want (some decent examples are in the discover app).

b) You could also do it with a little tree of ConditionSwitcher modules to fork the logic and different ViewRedirectors underneath but that's a bit nutty.

One more note is that if you download the sideview_utils app, install it and follow the directions, you get yourself a couple more tools for problems like this. In particular you can use the Sideview module Redirector which automatic $foo$ substitution on all of it's params, including the url param. So for instance if the values of the yellow and blue are literally the same as the view names you need to go to, then you maybe just need to use that. However I suspect your story is complicated enough that you might need to attach a custom behavior even in the SV world. SV stuff makes this path a bit easier too -- at least there's a module called CustomBehavior (and all the modules have a param called customBehavior too) and how this attaches to the view is more reusable and less brittle.

However CustomBehavior is not yet well documented in sideview_utils so until some other apps go up or I write some examples for it, that's a bit of a problem.

sorry; this is kind of a long winded way of saying not really. =(

[Ant1D]

It's a bit of a shame that this cannot be done 😞 Having this functionality would lead to a whole new level of flexibility. It would allow me to be very clever with drilldowns from charts. It would be good to have this functionality in a future version of Splunk

[ayme]

Should be answered in http://answers.splunk.com/questions/8133/flashchart-drilldown-question-which-calls-a-new-search but otherwise let us know