Dashboards & Visualizations

Drill down from pie chart

appleman
Contributor

Hello,

How can I drill down from pie chart to my search?
I added the drill down link on my dashboard XML, but it didn't work.

Thank you in advance.


パイチャートの値をクリックして、ドリルダウンで自分で作成したサーチにリンクさせる方法を教えて下さい。





iOS
index=A sourcetype=app_log id=abc type=I
| stats count by name
| sort - count | head 20

0
now
visible
visible
linear
linear
pie
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right


<![CDATA[ /app/search/search?q=search%20index%3DA%20sourcetype%3Dapp_log%20source!%3D4XXX.csv%20id%3Dabc%20$row.name$%20%7C%20stats%20count%20by%20id%20%7%20sort%20-%20count%20%7%20head%2020%20&earliest=0&latest=]]>


0 Karma
1 Solution

melonman
Motivator

Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.

== pie1.xml

<form>
  <label>pie1</label>
  <description/>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default/>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>pie</title>
      <searchString>index=_* | top sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">right</option>

<drilldown>
  <link>
  <![CDATA[
/app/search/pie2?form.st=$click.value$
  ]]>
  </link>
</drilldown>
    </chart>
  </row>
</form>

alt text

== pie2.xml

<form>
  <label>pie2</label>
  <description/>
  <fieldset autoRun="true">
    <input type="text" token="st">
      <default>*</default>
    </input>  
  </fieldset>
  <row>
    <chart>
      <title>chart1</title>
      <searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
    </chart>
  </row>
  <row>
    <event>
      <title>raw</title>
      <searchString>index=_* sourcetype=$st$ | head 10</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="list.drilldown">full</option>
      <option name="list.wrap">1</option>
      <option name="maxLines">5</option>
      <option name="raw.drilldown">full</option>
      <option name="rowNumbers">0</option>
      <option name="table.drilldown">1</option>
      <option name="table.wrap">1</option>
      <option name="type">list</option>
      <fields>["host","source","sourcetype"]</fields>
    </event>
  </row>
</form>

alt text

View solution in original post

melonman
Motivator

Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.

== pie1.xml

<form>
  <label>pie1</label>
  <description/>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default/>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>pie</title>
      <searchString>index=_* | top sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">right</option>

<drilldown>
  <link>
  <![CDATA[
/app/search/pie2?form.st=$click.value$
  ]]>
  </link>
</drilldown>
    </chart>
  </row>
</form>

alt text

== pie2.xml

<form>
  <label>pie2</label>
  <description/>
  <fieldset autoRun="true">
    <input type="text" token="st">
      <default>*</default>
    </input>  
  </fieldset>
  <row>
    <chart>
      <title>chart1</title>
      <searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
    </chart>
  </row>
  <row>
    <event>
      <title>raw</title>
      <searchString>index=_* sourcetype=$st$ | head 10</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="list.drilldown">full</option>
      <option name="list.wrap">1</option>
      <option name="maxLines">5</option>
      <option name="raw.drilldown">full</option>
      <option name="rowNumbers">0</option>
      <option name="table.drilldown">1</option>
      <option name="table.wrap">1</option>
      <option name="type">list</option>
      <fields>["host","source","sourcetype"]</fields>
    </event>
  </row>
</form>

alt text

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...