Dashboards & Visualizations

How to drilldown a pie chart and get specific results for each slice of pie?

snayani
Explorer

I am trying to drill down pie chart. When I click on the slice of pie, I have selected an option to go to the search page for that report.
Here, I want to have specific results for each slice of pie. For example, if I click on the slice, that should fetch only that pie's events, based on the search link in the drill down.
The question here is when I click on search, the value of search string should change dynamically based on the click value.
For example if the click value="Connection Refused" then the drilldown-> link-> target -> search query should have the string "ERRORCODE=-4492" instead of "Connection Refused."

Thanks in advance

Tags (3)
0 Karma
1 Solution

kmaron
Motivator
            <drilldown>
              <set token="token_name">$click.value$</set>
              <link target="_blank">search?q=(sql goes here)</link>
            </drilldown>
          </chart>

Add a drilldown to your chart that sets the token from click.value. then use the token in your search

View solution in original post

snayani
Explorer

Finally, I could figure out how to deal with this scenario.

Example:

**<drilldown> <condition match="$click.value$ == &quot;Connection Authorization Failure&quot;"> <link target="_blank">search?q=index="abc" attrs.io.kubernetes.pod.namespace=xyz "ERRORCODE=-4214" earliest=$Intergration_Errors_Time_Range_Picker.earliest$&amp;latest=$Intergration_Errors_Time_Range_Picker.latest$</link> </condition> <drilldown>**

This way, we can have a link defined for a specif condition without having to define any tokens.

0 Karma

kmaron
Motivator
            <drilldown>
              <set token="token_name">$click.value$</set>
              <link target="_blank">search?q=(sql goes here)</link>
            </drilldown>
          </chart>

Add a drilldown to your chart that sets the token from click.value. then use the token in your search

snayani
Explorer

Hi kmaron,
Thank you for your help.
Please let me know if there is a way that the token value could be different for each $click.value$.

0 Karma

snayani
Explorer

Apologies for not being clear on my question. I would like to know if there is a way like
set a condition for example, if the click.value== "Connection Refused" set token value ="ERRORCODE=-4992" etc, and this token value will be used in the target search query.

0 Karma

kmaron
Motivator

oh! Yes you should be able to do something like this

<eval token="ErrorCode">case(match($click.value$, "Connection Refused"), "ERRORCODE=-4992")</eval>
0 Karma

snayani
Explorer

Thanks again!!. I tried as shown below.Only the last one is working correctly. Rest all other tokens are being evaluated to null.

      <eval token="error_code">case(match($click.value$, "Connection is closed"), "ERRORCODE=-4470")</eval>
      <eval token="error_code">case(match($click.value$, "Connection Refused"), "ERRORCODE=-4499")</eval>
      <eval token="error_code">case(match($click.value$, "Connection Authorization Failure"), "ERRORCODE=-4214")</eval>
      <eval token="error_code">case(match($click.value$, "Unknown Host"), "ERRORCODE=-4222")</eval>
      <link target="_blank">search?q=index="xyz" attrs.io.kubernetes.pod.namespace=abx-int "$error_code$" earliest=$Intergration_Errors_Time_Range_Picker.earliest$&amp;latest=$Intergration_Errors_Time_Range_Picker.latest$</link>
    </drilldown>
0 Karma

kmaron
Motivator

the token will be set from whatever is clicked automatically.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...