Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Drilldown in Bar chart with value that is not contained in grouping

$
0
0
Hello I have the following chart set up and would like to add a drilldown on a value that is currently not contained in the query. Runtimesourcetype=avq_test_case type=run task_templ="$task_templ$" result=$result$ db=$db$ | eval t_start=strptime(timestamp_start, "%Y-%m-%d %H:%M:%S") | eval t_end=strptime(timestamp_end, "%F %H:%M:%S") | eval t=(t_end-t_start) | chart max(t) as "time in s" by timestamp_start, result | rename timestamp_start as "Timestamp" | sort t$field1.earliest$$field1.latest$1 The search has a field defined called uuid, however I cannot refer to it in the drilldown link, I tried $row.uuid$ and $uuid$, neither worked. avaloq_kupima_run_details?form.uuid=$uuid$ Is it somehow possible to add a new dimension which can be accessible in the drilldown? Or is it possible to overwrite the value of a bar s.t. I can encode the UUID inside? One option I looked into was to add instead of the result (which is success/failed) an evaluated variable which contains both the result status and the UUID. Problem with that approach is that I cannot assign the field colors as charting.fieldColors does not support wildcards or regex. Any ideas?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>