How to capture x,y data from stacked charts for dr...

GaryZ · ‎09-25-2023

Is there a way of capturing the x, y and z data from a stacked chart?

At the moment, my x and y are as follows

x = build info

y = duration

z = process name. (various names stacked in the same column)

bowesmana · ‎09-25-2023

The drilldown tokens for a stacked chart will be

Value of the X-axis (where x_axis_name is the name of the field on your x-axis - i.e. build info) - both of these will work.

$click.value$
$row.x_axis_name$

Name of the X-axis column

$click.name$

Value of the clicked stacked element (duration)

$click.value2$

and name of the clicked stacked element (process name)

$click.name2$

GaryZ · ‎09-26-2023

@bowesmana ,

I've created the tokens via Drilldown Editor. However when I try using the tokens in a panel, ie.

| stats values($value2$), values($trellis_split$), values($trellis_value$), values($row_axis_name$), values($row_fieldname$), values($d_trellis_split$), values($d_trellis_value$), values($d_trellis_name$), values($d_value1$),

I'm only seeing name1 & trellis_name. Everything else is blanked.

bowesmana · ‎09-26-2023

If you have values that contain spaces or other punctuation characters, then you should ensure the tokens quote the values, which is normally done with

| stats values($value2|s$)...

i.e. adding |s before the final $ sign, that tells Splunk to quote the token value.

However, in the above, your values() statements are expecting FIELD NAMES, containing values, whereas the value of the $value2$ token will be the clicked duration, and so values($value2$) is meaningless.

What are you actually trying to do with that stats statement - is it just to debug things?

Sometimes when debugging token things, it's useful to just add an html panel inside the dashboard where you can render the tokens, e.g.

<row>
  <panel>
    <html>
      <h2>name1=$name1|s$</h2>
      <h2>value1=$value1|s$</h2>
    </html>
  </panel>
</row>

GaryZ · ‎10-04-2023

@bowesmana

I'm using the stats statement to help with debugging the actions I'm doing on the UI. I've tried adding a html panel to help better understand the various actions from the drill down. However I'm not seeing what I'm expecting to see.

I currently have a stacked column chart. I would like to hover or click on any of the data in the stacked chart, to get the x,y, z data. (i.e. x = build, y = duration time, and z= name of task/column-segment)

Do you happen to know how I can capture this information, when I click on a point in the stacked column?

bowesmana · ‎10-04-2023

Please refer to my first post - these are the tokens that represent the attributes of your chart for when you click on the chart. Your stats statement will NOT show the clicked values because it's an incorrect statement.

What is your HTML panel and what are you seeing when you click values and what are you expecting to see. Please show the XML for your drilldown and HTML panel.

GaryZ · ‎10-05-2023

@bowesmana

I've used this code to check on the values

      <html>
        <h3>Token values</h3>
        <table border="0" cellpadding="12" cellspacing="0">
          <tr>
            <td>
              <p>
                <b>Time range (epoch time)</b>
              </p>
              <p>
                <b>$$timeSelect1.earliest$$</b>: $timeSelect1.earliest$<br/>
                <b>$$timeSelect1.latest$$</b>: $timeSelect1.latest$<br/>
                <b>$$timeSelect1.earliest_ts$$</b>: $timeSelect1.earliest_ts$<br/>
                <b>$$timeSelect1.latest_ts$$</b>: $timeSelect1.latest_ts$<br/>
                <b>$$earliest$$</b>: $earliest$<br/>
                <b>$$latest$$</b>: $latest$<br/>
                <b>$$table_minutes_away$$</b>: $table_minutes_away$<br/>
                <b>$$drilldownsettingtimerange$$</b>: $drilldownsettingtimerange$<br/>
              </p>
            </td>
             <td>
              <p>
                <b>Filter Values</b>
              </p>
              <p>
                <b>$$displayUnits$$</b>: $displayUnits$<br/>
                <b>$$filterBy$$</b>: $filterBy$<br/>
                <b>$$removeParam$$</b>: $removeParam$<br/>
                <b>$$rankBy$$</b>: $rankBy$<br/>
                <b>$$filterNWCompletionCode$$</b>: $filterNWCompletionCode$<br/>
                <b>$$filterNWPredictionCode$$</b>: $filterNWPredictionCode$<br/>
                <b>$$useLoad$$</b>: $useLoad$<br/>
                <b>$$showLive$$</b>: $showLive$<br/>
              </p>
            </td>
            <td>
              <p>
                <b>Click Values</b>
              </p>
              <p>
                <b>$$job.runDuration$$</b>: $job.runDuration$<br/>
                <b>$$whereclick$$</b>: $whereclick$<br/>
                <b>$$clickname$$</b>: $click.name$<br/>
                <b>$$clickvalue$$</b>: $click.value$<br/>
                <b>$$clickname2$$</b>: $click.name2$<br/>
                <b>$$clickvalue2$$</b>: $click.value2$<br/>
                <b>$$clickearly$$</b>: $clickearly$<br/>
                <b>$$clicklate$$</b>: $clicklate$<br/>
                <b>$$row.duration$$</b>: $row.duration$<br/>
                <b>$$rownode$$</b>: $rownode$</p>
            </td>
            <td>
              <p>
                <b>Search Values</b>
              </p>
              <p>
                <b>$$radar|s$$</b>: $radar|s$<br/>
                <b>$$form.pre_source$$</b>: $form.pre_source$<br/>
                <b>$$form.source|s$$</b>: $form.source|s$<br/>
                <b>$$source$$</b>: $source$<br/>
                <b>$$form.terms|s$$</b>: $form.terms|s$<br/>
                <b>$$terms$$</b>: $terms$<br/>
                <b>$$subsystems|s$$</b>: $subsystems|s$<br/>
                <b>$$categories|s$$</b>: $categories|s$<br/>
                <b>$$hidden$$</b>: $hidden$<br/>
                <b>$$mlModelsAvailable$$</b>: $mlModelsAvailable$</p>
            </td>
            <td>
              <p>
                <b>Search Values</b>
                </p>
              <p>
                <b>$$search_results$$</b>: $search_results$<br/>
              </p>
              </td>
          </tr>
        </table>
      </html>

This is what I see when I clicked on any parts of the stacked charts (no difference in values)

bowesmana · ‎10-05-2023

Without seeing how you assign the tokens, it's hard to say why they are not showing anything, but you have to assign the click names and values in the <drilldown> section - these will not show any value outside that, so this will never work.

<b>$$clickname$$</b>: $click.name$<br/>
<b>$$clickvalue$$</b>: $click.value$<br/>
<b>$$clickname2$$</b>: $click.name2$<br/>
<b>$$clickvalue2$$</b>: $click.value2$<br/>

Here is a working example of a <row> that shows you how it works

  <row>
    <panel>
      <chart>
        <search>
          <query>index=_audit
| chart count over user by action</query>
          <earliest>-4h@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="user">$row.user$</set>
          <set token="CV">$click.value$</set>
          <set token="CN">$click.name$</set>
          <set token="CV2">$click.value2$</set>
          <set token="CN2">$click.name2$</set>
        </drilldown>
      </chart>
      <html depends="$CV$">
        <h2>CV=$CV$</h2>
        <h2>CN=$CN$</h2>
        <h2>CV2=$CV2$</h2>
        <h2>CN2=$CN2$</h2>
        <h2>User=$user$</h2>
      </html>
    </panel>
  </row>

GaryZ · ‎10-06-2023

@bowesmana Thank you. Your example helped me grasp this better.

How to capture x,y data from stacked charts for drill down option

chart

field extraction

lookup

other

stats

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

.conf24 | Session Scheduler is Live!!

Introducing the Splunk Community Dashboard Challenge!