Dashboards & Visualizations

How to view logs in a pie chart in each individual slice?

navd
New Member

HI,
I have created a pie chart which has 3 different pie slices, so My question is if I click on each individual pie slice I want to open its respective logs, is that possible? and how?

0 Karma

mayurr98
Super Champion

hey
1) If you want to drill-down to a new search window then you can try this run anywhere XML

<form>
  <label>Drilldown-to-search</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>TimePicker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_audit | stats count by action</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <link target="_blank">search?q=index=_audit action="$row.action$"&amp;earliest=$field1.earliest$&amp;latest=$field1.latest$</link>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

2) If you want drill-down to show the logs in the same dashboard in the form of table then try this run anywhere XML

<form>
  <label>Drilldown-to-search</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>TimePicker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_audit | stats count by action</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <set token="action">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <title>raw logs for $action$</title>
        <search>
          <query>index=_audit action="$action$"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</form>

let me know if this helps!

0 Karma

493669
Super Champion

Try this:

<option name="charting.drilldown">all</option>
<drilldown>
          <set token="sourcetype_tok">$click.value$</set>
</drilldown>

Use this token $sourcetype_tok$ in your query
Try this run anywhere search:

<dashboard>
  <label>PieChartLabelName</label>
  <row>
    <panel>
      <chart id="myPieChart">
        <search>
          <query> index=_internal | stats count by log_level </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
         <option name="charting.drilldown">all</option>
        <drilldown>

            <set token="sourcetype_tok">$click.value$</set>

       </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$sourcetype_tok$">
      <table>
        <title>$sourcetype_tok$</title>
        <search>
          <query> index=_internal log_level="$sourcetype_tok$"| stats count by log_level </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
      </panel>
    </row>
</dashboard>
0 Karma

lguinn2
Legend

By default, clicking on a chart will open a browser tab that displays the underlying events.
If that is not what you want, you can customize the drill-down behavior by adding the chart to a dashboard. Within a dashboard, there are a number of ways that you can customize.

The Splunk Dashboards Example app is free and shows excellent examples of drill-downs. I would install this app on a test machine or your personal copy of Splunk. It won't hurt anything, but it really doesn't belong in your production environment. You can download it here http://splunkbase.splunk.com/app/1603/

If you prefer to read the manual, the section on drill-downs appears here
http://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownIntro

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...