topic Why does the clickable pie chart only show the IP address in question? in Splunk Search

Why does the clickable pie chart only show the IP address in question?

jhilton90 — Wed, 02 Nov 2022 20:11:06 GMT

I have a pie chart displaying the top 10 ip address for the past 60 minutes, and I'm trying to figure out how to then be able to click that bit of the pie chart, to then open a new window relevant information about that specific ip address instead of all the IP addresses in the pie chart

Re: Clickable Pie Chart that only shows the IP Address in question

gcusello — Wed, 02 Nov 2022 13:19:26 GMT

Hi @jhilton90,

you need to explore the drilldown feature:

https://docs.splunk.com/Documentation/Splunk/9.0.1/Viz/DrilldownIntro

and many other videos on the YouTube Splunk Channel.

I cannot help you more, because it depends on your dashboard, anyway, you could use the GUI drilldown feature that you can find in all panels (clicking on the three dots in edit mode).

viewing code, you should have in your dashboard something like this:

and in the new dashboard put a token with the same name you used (in my samle "ip").

Ciao.

Giuseppe

Re: Clickable Pie Chart that only shows the IP Address in question

richgalloway — Wed, 02 Nov 2022 13:25:18 GMT

Define a drilldown for the chart that links to a search. The search should reference the $click.value2$ token to find only the clicked IP address.

Re: Why does the Clickable Pie Chart only shows the IP Address in question?

jhilton90 — Wed, 02 Nov 2022 16:39:38 GMT

Okay so just to update, on the pie chart we have 10 offending ip addresses.

The drilldown options are set as follows:

And so when I click on one of the ip address on the pie chart, I want a table below to be populated with the following details regarding that ip address: ipAddress, username, error, _time. However this is what appears when I click on any of the ip addresses in the pie chart

Re: Why does the Clickable Pie Chart only shows the IP Address in question?

richgalloway — Wed, 02 Nov 2022 17:27:27 GMT

Change the drilldown option to "Link to search" and choose "Custom". Enter into the "Search string" box the SPL needed to create the desired table. Use $click.value2$ to refer to the selected IP address.

Re: Why does the Clickable Pie Chart only shows the IP Address in question?

jhilton90 — Thu, 03 Nov 2022 16:13:16 GMT

Thanks, I'll try that ASAP!