This Article is a continuation of Location Tracking in Splunk
The point here is to drilldown on each unique timestamp in the Followmee data and by clicking at the data, get a map representation on the actual location. This involves using "drilldown" to pass data at click to a timepicker, which makes the map refresh.
Also , the Followmee time is a single timestamp, whereas a search is a date-time range (from → to).
On the right, the source code for the Dashboard is present:
The dashboard contains 2 Time pickers:
One for seleting the date time range for the table data, to click on
One for holding the date time range for the map search
The code for the table:
<table> <search> <query>index="followmee" | dedup _time | eval User="Normann" | table _time "Data{}.Latitude" "Data{}.Longitude" User</query> <earliest>$TableTime.earliest$</earliest> <latest>$TableTime.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <eval token="e">$click.value$ +1</eval> <set token="form.SelectedDateTime.earliest">$click.value$</set> <set token="form.SelectedDateTime.latest">$e$</set> </drilldown> </table>
In the Drilldown part, we take the date time and add 1 to the time, to get a new date time
Then we pass the date time and the date time added with 1 to the timepicker "SelectedDateTime"
When the "SelectedDateTime" Time Picker has new dates, it will refresh the map due to the searchWhenChanged="true" on it
The Dashboard
Video of the functionality
The complete source for the Dashboard
<form script="panels.js"> <label>Follow Mee Location Tracking Drilldown</label> <fieldset submitButton="true" autoRun="true"> <input type="time" token="TableTime"> <label>Table Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="time" token="SelectedDateTime" searchWhenChanged="true"> <label>Map Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <viz type="location_tracker_app.location_tracker"> <search> <query>index="followmee" | eval User="Normann" | table _time "Data{}.Latitude" "Data{}.Longitude" User</query> <earliest>$SelectedDateTime.earliest$</earliest> <latest>$SelectedDateTime.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>30s</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="location_tracker_app.location_tracker.interval">100000</option> <option name="location_tracker_app.location_tracker.showTraces">0</option> <option name="location_tracker_app.location_tracker.staticIcon">space-shuttle</option> <option name="location_tracker_app.location_tracker.tileSet">openstreetmap_tiles</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> <panel> <title>Data from Followmee</title> <table> <search> <query>index="followmee" | dedup _time | eval User="Normann" | table _time "Data{}.Latitude" "Data{}.Longitude" User</query> <earliest>$TableTime.earliest$</earliest> <latest>$TableTime.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <eval token="e">$click.value$ +1</eval> <set token="form.SelectedDateTime.earliest">$click.value$</set> <set token="form.SelectedDateTime.latest">$e$</set> </drilldown> </table> </panel> </row> </form>