Splunk Drilldown Tokens: $click.name$ (Part-I)

Splunk Drilldown Tokens: $click.name$ (Part-I)

In this series of Splunk drilldown tokens we will try to cover all the possible aspects of Splunk drilldown functionalities from basic drilldown features like the link to search, link to the dashboard, and link to URL to advanced feature all drilldown tokens and many more insight ideas of Splunk advance drilldown. Therefore if you are interested in making your dashboard customizable and interactive then stay tuned to the Splunk drilldown series.

In this first blog of the series, we will cover all aspects of $click.name$ token,

1. chart viz: $click.name$ for chart
2. table viz: $click.name$ for table
3. event viz: $click.name$ for event
4. single value viz: $click.name$ for trellis

$click.name$ for chart:

It passes the X-axis field or category name for the clicked location.

Example:

I have a chart viz added into my dashboard like this,

In the X-axis I have “_time” and in the Y-axis I have “bytes”. Now will add $click.name$ token to pass the X-axis field-name i.e. “_time”.

Now go to the dashboard, click on edit and click on three dots available on the right side of your panel.

After that, click on “Edit Drilldown”

And after that insert token name and value,

And click on apply.

If you want to add from the source code it will look like this,

<drilldown>
          <set token="new">$click.name$</set>
 </drilldown>

Remember this step will be the same as adding all drilldowns from the UI and source code. So for the further demo, I won’t repeat these steps. Unless it is different from this.

Result:

Now to see what the token is passing I added an extra panel side of that to see.

And the query of that panel is given below,

| makeresults 
| eval new="$new$"
| fields new

Within the new field, you can see I passe the newly created token, always remember you need t put your token within the “$$” (dollar sign). Otherwise, Splunk won’t recognize its remarks as a token.

Now if I click on the chart it will pass “_time” value from the chart viz with the help of the “$click.name$” token.

Download the full source code:

$click.name$ for table:

with the table viz “$click.name$” will pass left most field-name of the table.

Example:

I have this table,

Result:

Now if I click anywhere in the table it will pass left most field-name from the table i.e. “host”

Download the full source code:

$click.name$ for event:

for event viz, if you click on the timestamp it will pass _time and if you click on the event it will pass _raw.

Result:

Download the full source code:

$click.name$ for trellis single value:

in the case of trellis single value $click.name$ represents as $trellis.name$. It passes split by field name from the viz.

Result:

Here we took the method as a split by field into the trellis. That’s why it is showing “method” after clicking.

Download the full source code:

Hope you all enjoyed this blog “Splunk Drilldown Tokens: $click.name$ (Part-I)”. Will will back with the next part of this series which will cover “$click.value$”.

To get more drilldown blogs: Click Here

Happy Splunking!!