topic Re: Creating stacked Bar with multiple values in Splunk Search

Creating stacked Bar with multiple values

ashishlal82 — Thu, 14 Jul 2016 14:00:13 GMT

I have a field "Allow/Deny"(fildName) which has values Allow/ Deny for a particular Host. How can I produce a stacked chart with number of Allow & Deny for a particular HostName?
This below query just gives me a count
stats count(Authorized/Unauthorized) by HostNames

Re: Creating stacked Bar with multiple values

somesoni2 — Thu, 14 Jul 2016 14:14:20 GMT

Try like this (check the exact field name in by clause)

your base search |chart count over HostNames by "Authorized/Unauthorized"

This should give your fields HostNames, Allow, Deny. Once you get that go to visualization, select column chart and stacked option

Re: Creating stacked Bar with multiple values

ashishlal82 — Thu, 14 Jul 2016 17:43:22 GMT

Thanks, I was able to create the stacked Bar chart. how do I Create drill-down on a stacked bar chart so that for a particular Hostname, wheather clicked Auth / Unauth would display another table with list of software by HostName that are either Auth/Unauth. I have reading this http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms for reference> Not sure where to start

Re: Creating stacked Bar with multiple values

somesoni2 — Thu, 14 Jul 2016 17:53:58 GMT

See the list of tokens that you can use in the drilldown here
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event_tokens

You would need these
click.value Value of the field or category for the x-axis. Not available when the legend has been clicked.
click.name2 Name of the field or series for the y-axis.

See this for solution for same page drilldown
https://answers.splunk.com/answers/113562/same-page-drilldown-splunk-6-simple-xml.html

Re: Creating stacked Bar with multiple values

ashishlal82 — Thu, 14 Jul 2016 19:40:18 GMT

The examples in the link help you to create a Form from drill down table. I am trying to drill down from stacked bar chart to a table(destination) within the same panel

Authorized_List
This Dashboard presents List of Assets with number of Authorized and Unauthorized files

<panel>
  <title>Number of Authorized And Unauthorized Files by Assets</title>
  <chart>
    <title>Authorized_Files</title>
    <search ref="Authorized_Files"></search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">bar</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">stacked</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
    <drilldown>
      <set token="type_tok">$click.value2$</set>
      <set token="cat_tok">$click.name$</set>
      <drilldown target =" List of Softwares"
      <link>List of Softwares </link>
     </drilldown>
  </chart>

</panel>

Eventually what I am trying to do is if anyone clicks Auth/unauth bar for a particular asset which is my Y- axis, it should display a table list of software installed on that hostname.

Re: Creating stacked Bar with multiple values

ashishlal82 — Thu, 14 Jul 2016 19:41:13 GMT

Question: 1) Should I create a destination dashboard and then link it? or does Splunk creates it dynamically?

Re: Creating stacked Bar with multiple values

somesoni2 — Thu, 14 Jul 2016 19:59:30 GMT

You would have to create the drilldown dashboard and provide link to that dashboard and pass required tokens.

Re: Creating stacked Bar with multiple values

ashishlal82 — Tue, 29 Sep 2020 10:15:31 GMT

This is what my source dashboard looks like
$click.value2$
$click.name$

list_of_software_by_hostnames?form.host_value
list_of_software_by_hostnames?form.cat_name
Question: is host_value and cat_name fields available to the destination dashboard in the same app?
2) Do I create a new fields in the destination dashboard and pass the value / or I can directly use them in a query?