Say I have the fields id
and name
, I would like to produce a chart that show the count by name
, so it is readable by the user of the dashboard.
The problem is that I would like to use the drill down on the chart to set a token based on the id
for that row.
Ive tried using a stats query like so:
index=myindex *
| stats count by name id
and then in the xml:
<option name="charting.data.fieldShowList">["name","count"]</option>
however, the drill down cannot access the id field, and it just populates the input with the literal string "$row.id$"
<drilldown>
<condition field="*">
<set token="form.id">$row.id$</set>
</condition>
</drilldown>
@tmortiboy, you should actually have used fieldHideList to hide id from being displayed and yet drilldown on the same.
<option name="charting.data.fieldHideList">["id"]</option>
Then use the id field in your drilldown:
<drilldown>
<set token="form.id">$row.id$</set>
</drilldown>
Unfortunately, this produces the same affect as charting.data.fieldShowList
, setting the value of the input to the literal string $row.id$
instead of the actual ID.
Hi @tmortiboy, sorry hidden fields in chart are not available for drilldown. The same in table can be used for drilldown. Following is run anywhere example through Splunk'd splunkd_ui_access logs which can drilldown based on hidden field uri:
<row>
<panel>
<table>
<search>
<query>index=_internal sourcetype=splunkd_ui_access uri=* uri_path=*
| stats count by uri_path uri
| sort - count
| head 10</query>
<earliest>-5m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">cell</option>
<fields>uri_path, count</fields>
<drilldown>
<set token="tok_uri">$row.uri$</set>
<set token="tok_uri_path">$row.uri_path$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
tok_uri: $tok_uri$
<br/>
tok_uri_path: $tok_uri_path$
</html>
</panel>
</row>
In your case you need chart with drilldown to more than one field while hiding them from being displayed in legend (second field is anyways not displayed anywhere on the chart upon hovering except for a label in the legend)
<row>
<panel>
<chart id="hideFirstLegend">
<search>
<query>index=_internal sourcetype=splunkd_ui_access uri=* uri_path=*
| stats count by uri_path uri
| sort - count
| head 10</query>
<earliest>-5m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.data.fieldShowList">[uri_path, uri, count]</option>
<option name="charting.chart">column</option>
<drilldown>
<set token="tok_uri">$row.uri$</set>
<set token="tok_uri_path">$row.uri_path$</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<html>
<style>
#hideFirstLegend .highcharts-legend-item:nth-child(1) {
visibility: hidden !important;
}
</style>
tok_uri: $tok_uri$
<br/>
tok_uri_path: $tok_uri_path$
</html>
</panel>
</row>
The following CSS Style override hides the first Legend in the chart named id="hideFirstLegend"
<style>
#hideFirstLegend .highcharts-legend-item:nth-child(1) {
visibility: hidden !important;
}
</style>
Please see if this fits your needs, or if you can use table instead to do this cleanly without CSS.