Hello
I have the following chart set up and would like to add a drilldown on a value that is currently not contained in the query.
Runtime sourcetype=avq_test_case type=run task_templ="$task_templ$" result=$result$ db=$db$
| eval t_start=strptime(timestamp_start, "%Y-%m-%d %H:%M:%S")
| eval t_end=strptime(timestamp_end, "%F %H:%M:%S")
| eval t=(t_end-t_start)
| chart max(t) as "time in s" by timestamp_start, result
| rename timestamp_start as "Timestamp"
| sort t $field1.earliest$ $field1.latest$ 1
The search has a field defined called uuid, however I cannot refer to it in the drilldown link, I tried $row.uuid$ and $uuid$, neither worked.
avaloq_kupima_run_details?form.uuid=$uuid$
Is it somehow possible to add a new dimension which can be accessible in the drilldown? Or is it possible to overwrite the value of a bar s.t. I can encode the UUID inside?
One option I looked into was to add instead of the result (which is success/failed) an evaluated variable which contains both the result status and the UUID. Problem with that approach is that I cannot assign the field colors as charting.fieldColors does not support wildcards or regex.
Any ideas?
↧