Hello, I need to make a drilldown from a linechart (with a timespan of 7d), the thing is that the drilldown needs to go whenever (day, in time) the user clicked. The linechart also has 3 lines coming from a few counts. The drilldown has to link to 3 different dashboards, (which I already have) depending on what line the user clicks on. I Only managed to achieve a drilldown but when clicking on the Legends.
Here is my timechart so far: (in the next version i will switch to tstats):
index=myindex action=failure
| timechart count AS count1 span=1d
| appendcols
[search index=myindex action=blocked
| timechart count AS count2 span=1d]
| appendcols [ search index=myindex action=success OR action=failure
| lookup mylookupforspecialusers user OUTPUT group
| search `time_restricted_groups`
| eval day = strftime(_time, "%A")
| eval hour = strftime(_time, "%H")
| eval ilicit_time = case((day="Sunday" OR day ="Saturday"),1 ,(hour >= 18), 1, (hour <= 8),1, 1==1, null())
| timechart span=1d count(ilicit_time) AS count3
| appendcols [ search index=myindex OR index=myindex2 action=success
| eventstats dc(src) AS distinct by user
| where distinct>1
| timechart span=1d dc(user) AS count4]]
| eval count5 = count3+count4
| timechart span=1d values(count1) AS "Failed logins" values(count2) AS "Total blocked accounts" values(count5) AS "User behavior"-7d@h now /app/myapp/BCRA-DSB-009-mydashboard1?form.limit=$click.value2$ /app/myapp/mydashboard2?form.limit=$click.value2$ /app/myapp/mydashboard3?form.limit=$click.value2$ |
I need help with the XML and the tokens, specially when passing time to the 3 dashboards from the 3 lines, over time. For example, if I mouseover and click on the first line on the segment corresponding to "Mon 22", the drilldown has to re-direct to the line's corresponding dashboard, and the info loaded on it has to correspond to that day.
Thanks!
Thanks!!
↧