Dashboards & Visualizations

How to pass different field value for drilldown on piechart?

nisu
Explorer

query : sourcetype=test | chart count by type, vendor | eval type_with_vendor=type.":".vendor | fields type_with_vendor, count, type

I want to show type_with_vendor and count on chart and pass type value on drilldown. How to do this? Is it any way to do?

Any help would be appreciated.

0 Karma

niketn
Legend

@nishu... How about reversing your eval and chart command.

sourcetype=test 
| eval type_with_vendor=type.":".vendor
| chart count by type, vendor 
| sort - count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...