Dashboards & Visualizations

How to do drilldown depending on which bar in the bar chart was being clicked?

lctanlc
New Member

I am running on Splunk 6.4.3 and below is my source that presents a bar chart with the name of the Action on x-axis and the count on y-axis:

testing

<panel>
  <chart>
    <search>
      <query> ...|stats count by Action </query>
    </search>
    <option name="charting.drilldown">all</option>
    ...
  </chart>
</panel>

Is it possible to bring up another bar chart when I clicked on one of the bar?
E.g.,
Bar chart shows the following, x-axis vs y-axis:
Action X = 250 count
Action Y = 50 count
Action Z = 2500 count

If I click on Action X, I would like to show another bar chart that shows a breakdown of Action X by department. I.e., query is ... Action = Action X | |stats count by Department.

0 Karma
1 Solution

cmerriman
Super Champion

you can use $click.value$ to set the new token based on what is clicked to open a new panel.

http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/tokens#Combine_literal_values_with_token_value...

 <panel>
   <chart>
     <search>
       <query> ...|stats count by Action </query>
     </search>
     <drilldown>
         <set token="newpanel>$click.value|s$</set>
    </drilldown>
     <option name="charting.drilldown">all</option>
     ...
   </chart>
 </panel>
  .....
<query>...Action=$click.value|s$....

View solution in original post

0 Karma

cmerriman
Super Champion

you can use $click.value$ to set the new token based on what is clicked to open a new panel.

http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/tokens#Combine_literal_values_with_token_value...

 <panel>
   <chart>
     <search>
       <query> ...|stats count by Action </query>
     </search>
     <drilldown>
         <set token="newpanel>$click.value|s$</set>
    </drilldown>
     <option name="charting.drilldown">all</option>
     ...
   </chart>
 </panel>
  .....
<query>...Action=$click.value|s$....
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...