Hi,
My requirement is to get a table format of selected fields when i click an particular segment of pie chart .
But when i click the pie chart i am getting a page loading for long time but no page appears .
Please let me know how to achieve this requirement .
sorry i couldnt post my xml code ,
i have used like this [search Assessment_Description="$click.value2$"]
Without seeing your dashboard, it's difficult to know what's causing the problem. Here is a working "run-anywhere" dashboard with a pie-chart and table. See if this gives you any ideas
<dashboard>
<label>Splunk Answers</label>
<row>
<panel>
<chart>
<search>
<query>index=_internal | stats count by sourcetype</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="st">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<table>
<search>
<query>index=_internal sourcetype="$st$" | table _time sourcetype</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</dashboard>
Hi umsundar2015,
sorry but I didn't understand you problem: you have a dashboard with a pie chart, clicking on a pie slice, you want drilldown in another dashboard passing the value of the pie slice, correct?
If this is your need, it isn't correct [search Assessment_Description="$click.value2$"]
Because in the mother dashboard you have to put this code
<drilldown>
<link>child_dashboard?=Assessment_Description=$click.value2$&TimeDa=$Time.earliest$&TimeA=$Time.latest$</link>
</drilldown>
Instead in the child dashboard you have to insert
your search Assessment_Description="$Assessment_Description$" | ...
In other words: in the father dashboard you have to associate to a token (Assessment_Description) the clicked value and in the child dashboard you have to search for the token value.
In my example there is also the way to pass Time Frames to the child dashboard.
If instead you want to perform a drilldown in the same dashboard, you have to insert in the mother panel
<drilldown>
<set token="Assessment_Description">$click.value2$</set>
</drilldown>
and in the child panel
your search Assessment_Description="$Assessment_Description$" | ...
Bye.
Giuseppe
Thank you Cusello ..
Without seeing your dashboard, it's difficult to know what's causing the problem. Here is a working "run-anywhere" dashboard with a pie-chart and table. See if this gives you any ideas
<dashboard>
<label>Splunk Answers</label>
<row>
<panel>
<chart>
<search>
<query>index=_internal | stats count by sourcetype</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="st">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<table>
<search>
<query>index=_internal sourcetype="$st$" | table _time sourcetype</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</dashboard>