This Article is a continuation of Location Tracking in Splunk

The point here is to drilldown on each unique timestamp in the Followmee data and by clicking at the data, get a map representation on the actual location. This involves using "drilldown" to pass data at click to a timepicker, which makes the map refresh.

Also , the Followmee time is a single timestamp, whereas the map requires a search that is date-time range (from → to).

The Dashboard

The Solution

The dashboard contains 2 Time pickers:

One for seleting the date time range for the table data "Table Time"

One for holding the date time range for the map search "Map Time"


The code for the table "Table Time":

<table>
        <search>
          <query>index="followmee" | dedup _time | eval User="Normann" | table _time "Data{}.Latitude" "Data{}.Longitude" User</query>
          <earliest>$TableTime.earliest$</earliest>
          <latest>$TableTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <eval token="e">$click.value$ +1</eval>
          <set token="form.SelectedDateTime.earliest">$click.value$</set>
          <set token="form.SelectedDateTime.latest">$e$</set>
        </drilldown>
      </table>

The interesting part here is the <drilldown> part, where we take the date time in the first column and add 1 to the time (the eval statement), to get a new date time

Then on click we pass the date time and the date time added with 1 to the timepicker "SelectedDateTime" here:

<eval token="e">$click.value$ +1</eval>
<set token="form.SelectedDateTime.earliest">$click.value$</set>
<set token="form.SelectedDateTime.latest">$e$</set>


When the "Map Time" Time Picker has new dates, it will refresh the map due to the searchWhenChanged="true" on it

<input type="time" token="SelectedDateTime" searchWhenChanged="true">
  <label>Map Time</label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


Video of the functionality

The complete source for the Dashboard

<form script="panels.js">
  <label>Follow Mee Location Tracking Drilldown</label>
  <fieldset submitButton="true" autoRun="true">
    <input type="time" token="TableTime">
      <label>Table Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="time" token="SelectedDateTime" searchWhenChanged="true">
      <label>Map Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <viz type="location_tracker_app.location_tracker">
        <search>
          <query>index="followmee" | eval User="Normann" | table _time "Data{}.Latitude" "Data{}.Longitude" User</query>
          <earliest>$SelectedDateTime.earliest$</earliest>
          <latest>$SelectedDateTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>30s</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="location_tracker_app.location_tracker.interval">100000</option>
        <option name="location_tracker_app.location_tracker.showTraces">0</option>
        <option name="location_tracker_app.location_tracker.staticIcon">space-shuttle</option>
        <option name="location_tracker_app.location_tracker.tileSet">openstreetmap_tiles</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
    <panel>
      <title>Data from Followmee</title>
      <table>
        <search>
          <query>index="followmee" | dedup _time | eval User="Normann" | table _time "Data{}.Latitude" "Data{}.Longitude" User</query>
          <earliest>$TableTime.earliest$</earliest>
          <latest>$TableTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <eval token="e">$click.value$ +1</eval>
          <set token="form.SelectedDateTime.earliest">$click.value$</set>
          <set token="form.SelectedDateTime.latest">$e$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Sider med lignende indhold (Related Content)