I have a pie chart with Name/Count, but for each name there is a key which then refers to a row in a KV store for that name.
So, I have a table with
Name, Count, key
The pie chart displays as expected, but when I click on the chart segment for a given name, I an trying to capture the token
<set token="key">$row.key$</set>
However, that always returns $row.key$, so won't give me the actual column content. Using $row.Name$ or $row.Count$ gives me the data in the table.
I can't find if this is supported or not.
Yes, the row is not working with a pie-chart. Can you check the below code to implement your use case?
<dashboard>
<label>States</label>
<row>
<panel>
<chart>
<title>States Chart</title>
<search>
<query>| inputlookup geo_attr_us_states | stats count by state_name</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="my_token">$click.value$</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<table depends="$my_token$">
<title>States Details</title>
<search>
<query>| inputlookup geo_attr_us_states where state_name="$my_token$" </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="count">5</option>
</table>
</panel>
</row>
</dashboard>
If you find my solution useful, an upvote would be appreciated.
In a pie chart you don't have a row. So for either key or value extraction to a token you'd need:
<set token="key">$click.value$</set>
<set token="value">$click.value2$</set>
Technically you do have rows, just that the column dimension is only drawn from column 1 (entity) and column 2 (count). You can in practice have as many columns in the table the pie chart is drawn from and the click values $row.col1$ and $row.col2$ work, but sadly $row.col3$ does not.
That's a pain, as in event tables, you can include hidden fields by using the fields element, but this doesn't work in charts .
Just wondered if there was a way to solve this, as it makes the drilldown search have to repeat with a where clause, but even then it's not safe, as the where works on click.value, not the key needed and that's not unique.
We have the same problem. We store a list of items in a row in the search that is used to create a pie chart. The end of the search looks as follows:
| streamstats count as Count, values(ITEM_ID) as ITEM_list by DEPT
| dedup DEPT sortby -Count
| table DEPT, Count, ITEM_list
The pie chart draws correctly, using DEPT as fields and Count as counts for the chart. In the drilldown, we set:
<set token="ITEM_list">$row.ITEM_list$</set>
The idea is to use the ITEM_list token in a subsequent search. This technique works perfectly with bar charts, but the drilldown for the pie chart does not set the token as required. I think this is a functionality that does not work in the pie chart.
Yes, pie chart does not support $row.X$ drilldown tokens 😞