Dashboards & Visualizations

Chart that displays name, but drilldown for ID

New Member

Say I have the fields id and name, I would like to produce a chart that show the count by name, so it is readable by the user of the dashboard.
The problem is that I would like to use the drill down on the chart to set a token based on the id for that row.

Ive tried using a stats query like so:

index=myindex *
| stats count by name id

and then in the xml:

<option name="charting.data.fieldShowList">["name","count"]</option>

however, the drill down cannot access the id field, and it just populates the input with the literal string "$row.id$"

<drilldown>
  <condition field="*">
    <set token="form.id">$row.id$</set>
  </condition>
</drilldown>
0 Karma

Legend

@tmortiboy, you should actually have used fieldHideList to hide id from being displayed and yet drilldown on the same.

<option name="charting.data.fieldHideList">["id"]</option>

Then use the id field in your drilldown:

 <drilldown>
     <set token="form.id">$row.id$</set>
 </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

New Member

Unfortunately, this produces the same affect as charting.data.fieldShowList, setting the value of the input to the literal string $row.id$ instead of the actual ID.

0 Karma

Legend

Hi @tmortiboy, sorry hidden fields in chart are not available for drilldown. The same in table can be used for drilldown. Following is run anywhere example through Splunk'd splunkd_ui_access logs which can drilldown based on hidden field uri:

  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd_ui_access uri=* uri_path=*
| stats count by  uri_path uri
| sort - count
| head 10</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">cell</option>
        <fields>uri_path, count</fields>
        <drilldown>
          <set token="tok_uri">$row.uri$</set>
          <set token="tok_uri_path">$row.uri_path$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        tok_uri: $tok_uri$
        &lt;br/&gt;
        tok_uri_path: $tok_uri_path$
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Legend

In your case you need chart with drilldown to more than one field while hiding them from being displayed in legend (second field is anyways not displayed anywhere on the chart upon hovering except for a label in the legend)

  <row>
    <panel>
      <chart id="hideFirstLegend">
        <search>
          <query>index=_internal sourcetype=splunkd_ui_access uri=* uri_path=*
| stats count by  uri_path uri
| sort - count
| head 10</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.data.fieldShowList">[uri_path, uri, count]</option>
        <option name="charting.chart">column</option>
        <drilldown>
          <set token="tok_uri">$row.uri$</set>
          <set token="tok_uri_path">$row.uri_path$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <style>
          #hideFirstLegend .highcharts-legend-item:nth-child(1) {
              visibility: hidden !important;
          }          
        </style>
        tok_uri: $tok_uri$
        &lt;br/&gt;
        tok_uri_path: $tok_uri_path$
      </html>
    </panel>
  </row>

The following CSS Style override hides the first Legend in the chart named id="hideFirstLegend"

        <style>
          #hideFirstLegend .highcharts-legend-item:nth-child(1) {
              visibility: hidden !important;
          }          
        </style>

Please see if this fits your needs, or if you can use table instead to do this cleanly without CSS.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!