How to create multiple drilldown in a pie chart?

[macadminrohit]

Hi,

I have a search query through which i am creating a pie chart. one piece of the pie chart will show the successful events, other piece will show the Error events from the search. My requirement is to drill down to the respective events by clicking on the pieces of the pie chart.

index=_internal sourcetype=abc host=server1 source!="*SEND_EMAILS*" NOT "NO ERRORS" | dedup source  | eval fail=if(searchmatch("error OR fail*"),1,0)  | stats count as Total sum(fail) as "Error/failed" | transpose

This creates a pie chart with error and total events. So if i click on Error piece it should take me to the events which resulted in error and if i click on rest of the pie chart it should take me to the total events.

[sundareshr · Accepted solution]

Try like this

<dashboard>
  <label></label>
  <row>
    <panel>
      <chart>
        <title>f:$f$</title>
        <search>
          <query>index=_internal sourcetype=abc host=server1 source!="*SEND_EMAILS*" NOT "NO ERRORS" 
| dedup source 
| eval fail=if(searchmatch("error OR fail*"),1,0) 
| stats count as Total sum(fail) as "Error/failed" 
| eval Total=100 
| eval "Error/failed"=25
| transpose</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <eval token="f">if(match($click.value$, "Error"), "error OR fail\*", "\*"</eval>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal sourcetype=abc host=server1 source!="*SEND_EMAILS*" NOT "NO ERRORS" 
| dedup source
| eval fail=if(searchmatch("$f$"),1,0) 
| where fail=1</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</dashboard>