Dashboards & Visualizations

How to create a table that, when I click on a value, drills down to a pie chart in the same dashboard?


Hi to everyone

I need a dashboard with a table and a chart:

1) In the table, a list with a count for dest_ip from Cisco ASA,

2) When I click an ip, I need a pie chart in the same dashboard, without reload, with top src_ip.

How can I do this?

I'll be thankful for any help

Best regards

0 Karma


Try this and change queries

  <label>In-Page Drilldown with Perma-linking</label>
  <fieldset submitButton="false">
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
    <input type="text" token="sourcetype" searchWhenChanged="true"></input>
    <table id="master">
      <searchString>index=_internal | stats count by sourcetype</searchString>
      <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
      <option name="drilldown">row</option>
        <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
        <set token="sourcetype">$row.sourcetype$</set>
        <!-- If we also set the form.sourcetype the input will get updated too -->
        <set token="form.sourcetype">$row.sourcetype$</set>
    <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
    <chart id="detail" depends="$sourcetype$">
      <title>Detail: $sourcetype$</title>
        <query>index=_internal sourcetype=$sourcetype$ | timechart count</query>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
      <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisTitleY2.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisY2.enabled">0</option>
      <option name="charting.axisY2.scale">inherit</option>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.bubbleMaximumSize">50</option>
      <option name="charting.chart.bubbleMinimumSize">10</option>
      <option name="charting.chart.bubbleSizeBy">area</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.showDataLabels">none</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">right</option>
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...