topic Re: Can we disable the drilldown for a specific field in pie chart? in Splunk Search

Can we disable the drilldown for a specific field in pie chart?

Priya312 — Fri, 07 Sep 2018 12:55:48 GMT

I have a pie chart which displays two things
1) ABC
2)XYZ

When I click on ABC, it should go to other Dashboard via drilldown. I am able to do this by providing the link.

But, when a person clicks on XYZ, it should not take any action. Even drill down to search Window is also not to be there.

I am using Splunk version 6.6.5

I have tried a couple of ways to achieve my requirement but I couldn't achieve it. I have provided those examples below:

method 1)

<condition match="match('click.value',&quot;XYZ&quot;)">
<link>qwerty.com</link>
</condition>
   <condition match="match('click.value',&quot;ABC&quot;)">
            <link></link>
</condition>

method 2)

<condition field="XYZ">
            <link>qwerty.com</link>
          </condition>
          <condition field="ABC">
             </condition>

Thank You in advance

Re: Can we disable the drilldown for a specific field in pie chart?

kamlesh_vaghela — Fri, 07 Sep 2018 14:13:57 GMT

@Priya312,

Can you please change match in your drilldown code?

If I want to match ABC with clicked value then code is

<condition match="'click.value'=&quot;ABC&quot;">

If I want to match XYZ with clicked value then code is

<condition match="'click.value'=&quot;XYZ&quot;">

My Sample code:

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <title>$A$ $B$</title>
      <chart>
        <search>
          <query>| makeresults | eval A="ABC,XYZ",A=split(A,",") | stats count by A</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <condition match="'click.value'=&quot;ABC&quot;">
            <set token="A">$click.value$</set>
            <set token="B">AXXXXXXXXX</set>
          </condition>
          <condition>
            <set token="A">$click.value$</set>
            <set token="B">BBBBBBBBBBB</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</dashboard>

Re: Can we disable the drilldown for a specific field in pie chart?

niketn — Sat, 08 Sep 2018 02:49:19 GMT

@Priya312, if the requirement is for Click to a new page for after clicking on one slice (i.e. ABC) and disable any action on click of other slice (i.e. XYZ), you should try the following code:

    <drilldown>
      <condition match="$click.value$==&quot;ABC&quot;">
        <!-- DRILLDOWN TO NEW PAGE WHEN ABC SLICE IS CLICKED-->
        <link target="_blank">https://www.google.com/search?q=$click.value$</link>
        <!-- SINCE ABOVE DRILLDOWN IS FOR ABC INSTEAD OF $click.value$ ABC CAN ALSO BE USED-->
      </condition>
      <condition>
        <!-- Leaving condition block empty treats it as default else case. 
               However, match="$click.value$==&quot;XYZ&quot;" can also be used -->
        <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED i.e. XYZ-->
      </condition>
    </drilldown>

Following is a run anywhere example, based on Splunk's _internal index which plots two slices WARN and ERROR. Drilldown for WANR opens a new link and that on ERROR does not do anything:

<form>
  <label>Pie Chart disable Drilldown for specific slice</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <title>$tokSet$| $tokSetLink$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level IN ("WARN","ERROR")
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$click.value$==&quot;WARN&quot;">
            <!-- DRILLDOWN TO NEW PAGE WHEN WARN IS CLICKED-->
            <link target="_blank">https://www.google.com/search?q=$click.value$</link>
          </condition>
          <condition>
            <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED-->
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

Re: Can we disable the drilldown for a specific field in pie chart?

Priya312 — Mon, 10 Sep 2018 04:54:40 GMT

Tq so much Niketnilay.It worked.