Hide drilldown panel when click on different pie chart.

[0waste_splunk]

I have dashboard with some panels. like, panel_row2_col1_grp1, panel_row2_col1_grp2, panel_row2_col1_grp3. All this grp contains pie chart. now from this pie chart i have created drilldown, which shows simpleresultstable on panel_row3_col1 for all the pie chart above.

Now problem is when I click on pie chart one after other all the drilldown showed on panel_row3_col1. I want to hide the panel_row2_col1_grp1's pie chart drilldown in panel_row3_col1 if somebody clicks on panel_row2_col1_grp2's pie chart.

Is there anyway i can hide previous drilldown if i click on second pie chart?

please help asap.

really appreciate any kind of help or reference.

thanks

[sideview · Accepted solution]

The answer here is to use the Gate module. Gate has two functions. The main one is to do things like this - have multiple interactions all drive one common set of modules.

here's an example that does exactly what you're asking. It has a pie c hart and then a timechart and drilldowns on both drive only one set of drilldown modules. Therefore you don't get this pileup of nearly identical drilldown config.

Gate module officially released in 2.5 so make sure you're up to date (latest is 2.6.3)

<module name="Search" layoutPanel="panel_row1_col1_grp1" autoRun="True">
  <param name="search">
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | stats sum(kb) as KB by series | sort - KB
  </param>
  <param name="earliest">-4h</param>

  <module name="HiddenChartFormatter">
    <param name="charting.chart">pie</param>
    <module name="FlashChart">
      <module name="Gate">
        <param name="to">testDrilldown</param>
      </module>
    </module>
  </module>
</module>

<module name="Search"  layoutPanel="panel_row1_col1_grp2" autoRun="True">
  <param name="search">
    index=_internal source=*metrics.log group="per_sourcetype_thruput" | timechart sum(kb) by series
  </param>
  <param name="earliest">-4h</param>

  <module name="HiddenChartFormatter">
    <param name="charting.chart.stackMode">stacked</param>
    <module name="FlashChart">
      <module name="Gate">
        <param name="to">testDrilldown</param>
      </module>
    </module>
  </module>

</module>

<module name="Gate" layoutPanel="panel_row2_col1" autoRun="True">
  <param name="id">testDrilldown</param>

  <module name="Search">
    <param name="search">
      index=* OR index=_* $row.searchTerms$ 
    </param>

    <module name="HTML">
      <param name="html"><![CDATA[
        <h3>$results.count$ events for sourcetype $click.searchTerms$ $search.timeRange.label$</h3>
      ]]></param>
    </module>

    <module name="Pager">
      <param name="entityName">events</param>

      <module name="Events">
        <param name="resizeMode">fixed</param>
        <param name="height">400px</param>
      </module>
    </module>
  </module>
</module>

There is documentation and an example under "Module Documentation > The Gate Module > Gate - Complex Drilldowns", but I just noticed there is actually a misconfiguration in my example. I'll fix that in the next release coming very soon.

[0waste_splunk]

Thanks Nick

I really appreciate your valuable time.

[sideview]

First one is right. Second one is not right. Here's my corrected version. Also with the lone Gate that you're pushing to, you don't have to nest him inside anything unless there's a reason to.

search->Button ->PostProcess1->JSChart->ValueSetter->Gate
->PostProcess2->JSChart->ValueSetter->Gate
->PostProcess3->JSChart->ValueSetter->Gate

->Gate->Search->SimpleResults

and you should look at Table over SimpleResultsTable while you're at it.

[0waste_splunk]

or
search->Button ->PostProcess1->JSChart->Search->Gate
->PostProcess2->JSChart->Search->Gate
->PostProcess3->JSChart->Search->Gate
->Gate->ValueSetter1->search->SimpleResutls
->ValueSetter2->search->SimpleResutls
->ValueSetter3->search->SimpleResutls
Am I right?

[0waste_splunk]

I have following structure
search->Button ->PostProcess->JSChart->Gate->to
->PostProcess->JSChart->Gate->to
->PostProcess->JSChart->Gate->to
->Gate->Search->SimpleResultsTable
Now you are saying I should
search->Button ->PostProcess1->JSChart->Search->Gate
->PostProcess2->JSChart->Search->Gate
->PostProcess3->JSChart->Search->Gate
->Gate->SimpleResultsTable

[sideview]

Just stitch in your 3 different Search modules upstream from the Gate module. Or you can keep the Search module downstream from the Gates, but have 3 ValueSetter modules up top, each setting a key like $baseSearch$, then in your Search module you can just that key in the 'search' param. Both will work.

[0waste_splunk]

Hey Nick,

I have one trouble. I have different Search for drilldown for pie chart. Now can you tell me is there a way to pass this to gate module?

I saw in your example you are running same search. but for me I have different serach. can I pass different search based on pie chart?

i.e., If i click on 1st Pie chart it will pass one search. If i click on 2nd pie chart then it will pass different search in the gate module.

P.S:I saw and change the panel on the sideview.

Please this is the last thing i have to do before my final presentation.

I will really appreciate your fastest response.

[0waste_splunk]

@nick

Thanks I will test this and I will let you know whether it work for me or not. thanks