topic Drilldown pie chart to non visible column in Dashboards & Visualizations

Drilldown pie chart to non visible column

bowesmana — Thu, 11 Jul 2019 06:00:08 GMT

I have a pie chart with Name/Count, but for each name there is a key which then refers to a row in a KV store for that name.

So, I have a table with

Name, Count, key

The pie chart displays as expected, but when I click on the chart segment for a given name, I an trying to capture the token

<set token="key">$row.key$</set>

However, that always returns $row.key$, so won't give me the actual column content. Using $row.Name$ or $row.Count$ gives me the data in the table.

I can't find if this is supported or not.

Re: Drilldown pie chart to non visible column

tiagofbmm — Thu, 11 Jul 2019 06:22:11 GMT

In a pie chart you don't have a row. So for either key or value extraction to a token you'd need:

      <set token="key">$click.value$</set>
      <set token="value">$click.value2$</set>

Re: Drilldown pie chart to non visible column

bowesmana — Thu, 11 Jul 2019 06:58:00 GMT

Technically you do have rows, just that the column dimension is only drawn from column 1 (entity) and column 2 (count). You can in practice have as many columns in the table the pie chart is drawn from and the click values $row.col1$ and $row.col2$ work, but sadly $row.col3$ does not.

That's a pain, as in event tables, you can include hidden fields by using the fields element, but this doesn't work in charts .

Just wondered if there was a way to solve this, as it makes the drilldown search have to repeat with a where clause, but even then it's not safe, as the where works on click.value, not the key needed and that's not unique.

Re: Drilldown pie chart to non visible column

BernardEAI — Mon, 16 Aug 2021 06:31:52 GMT

We have the same problem. We store a list of items in a row in the search that is used to create a pie chart. The end of the search looks as follows:

| streamstats count as Count, values(ITEM_ID) as ITEM_list by DEPT | dedup DEPT sortby -Count | table DEPT, Count, ITEM_list

The pie chart draws correctly, using DEPT as fields and Count as counts for the chart. In the drilldown, we set:

The idea is to use the ITEM_list token in a subsequent search. This technique works perfectly with bar charts, but the drilldown for the pie chart does not set the token as required. I think this is a functionality that does not work in the pie chart.

Re: Drilldown pie chart to non visible column

bowesmana — Mon, 16 Aug 2021 07:12:21 GMT

Yes, pie chart does not support $row.X$ drilldown tokens 😞

Re: Drilldown pie chart to non visible column

jhanvidattani — Sat, 21 Aug 2021 10:12:40 GMT

@bowesmana

Yes, the row is not working with a pie-chart. Can you check the below code to implement your use case?

<dashboard> <label>States</label> <row> <panel> <chart> <title>States Chart</title> <search> <query>| inputlookup geo_attr_us_states | stats count by state_name</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="my_token">$click.value$</set> </drilldown> </chart> </panel> </row> <row> <panel> <table depends="$my_token$"> <title>States Details</title> <search> <query>| inputlookup geo_attr_us_states where state_name="$my_token$" </query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="count">5</option> </table> </panel> </row> </dashboard>

If you find my solution useful, an upvote would be appreciated.