How to drilldown bar chart and populate the required data in table format?

[Ashwini008]

Hi ,

I wanted to know whether by clicking on the bar graph can we populate the different field values

For example i have bar graph showing the index name ,but when i drilldown on the bars i need to populate the sourcetype name associated with the index shown in the bar graph.

i have bar chart showing indexes . When i click on the  the bar's i want to display the sourcetype of the particural indexes. Now i am able to drilldown but i am not getting the required details i.e. source type.It is showing no results found since when clicked on the bar graph it takes the shown value .

 PFB CODE:

<drilldown>
<set token="indexname">$click.name2$</set>
</drilldown>

Query used in the second panel

index=* |search sourcetype="$indexname$"|table index sourcetype

Any suggestions?

[ITWhisperer]

Try using

<eval token="indexname">expression to convert $click.name2$ to sourcetype name</eval>

[richgalloway]

Searching for a sourcetype name the same as the index name is unlikely to produce results.  Try this query.

| metadata index=$indexname$ type=sourcetypes | eval index=$indexname$ | table index sourcetype