Dashboards & Visualizations
Highlighted

How to pass different field value for drilldown on piechart?

Explorer

query : sourcetype=test | chart count by type, vendor | eval typewithvendor=type.":".vendor | fields typewithvendor, count, type

I want to show typewithvendor and count on chart and pass type value on drilldown. How to do this? Is it any way to do?

Any help would be appreciated.

0 Karma
Highlighted

Re: How to pass different field value for drilldown on piechart?

Legend

@nishu... How about reversing your eval and chart command.

sourcetype=test 
| eval type_with_vendor=type.":".vendor
| chart count by type, vendor 
| sort - count



| eval message="Happy Splunking!!!"


0 Karma