Appropriate Drilldown from Summary Data

[Michael_Wilde]

I have a summary indexing job that summarizes the following

Top IP's hitting my website over a 5m period.

I have a piechart on my dashboard that runs a search against that summary index, but it looks for "Top IP's hitting my website over a 30day period". Perfect usecase for Summary Indexing.

Now, i'd like to be able to click on one of the pie chart elements and have it display the actual raw data, and not the summary indexing results.

How can i do that?

[ziegfried]

You can do this with something like this:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="true">
    <param name="search">index=summary report=top_client_ips | top clientip</param>
    <module name="HiddenChartFormatter">
        <param name="charting.chart">pie</param>
        <module name="FlashChart">
            <param name="height">250px</param>
            <param name="enableResize">false</param>
            <module name="HiddenSearch">
                <param name="search">sourcetype=access_combined clientip=$clientip$</param>
                <param name="earliest">-30d@d</param>
                <module name="ConvertToIntention">
                    <param name="settingToConvert">click.value</param>
                    <param name="intention">
                        <param name="name">stringreplace</param>
                        <param name="arg">
                            <param name="clientip">
                                <param name="value">$target$</param>
                            </param>
                        </param>
                    </param>
                    <module name="ViewRedirector">
                        <param name="viewTarget">flashtimeline</param>
                    </module>
                </module>
            </module>
        </module>
    </module>
</module>

The inner HiddenSearch is the search that is getting populated with the argument from the clicked area.