Dashboards & Visualizations

How to view logs in a pie chart in each individual slice?

New Member

HI,
I have created a pie chart which has 3 different pie slices, so My question is if I click on each individual pie slice I want to open its respective logs, is that possible? and how?

0 Karma

SplunkTrust
SplunkTrust

hey
1) If you want to drill-down to a new search window then you can try this run anywhere XML

<form>
  <label>Drilldown-to-search</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>TimePicker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_audit | stats count by action</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <link target="_blank">search?q=index=_audit action="$row.action$"&amp;earliest=$field1.earliest$&amp;latest=$field1.latest$</link>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

2) If you want drill-down to show the logs in the same dashboard in the form of table then try this run anywhere XML

<form>
  <label>Drilldown-to-search</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>TimePicker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_audit | stats count by action</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <set token="action">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <title>raw logs for $action$</title>
        <search>
          <query>index=_audit action="$action$"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</form>

let me know if this helps!

0 Karma

Super Champion

Try this:

<option name="charting.drilldown">all</option>
<drilldown>
          <set token="sourcetype_tok">$click.value$</set>
</drilldown>

Use this token $sourcetype_tok$ in your query
Try this run anywhere search:

<dashboard>
  <label>PieChartLabelName</label>
  <row>
    <panel>
      <chart id="myPieChart">
        <search>
          <query> index=_internal | stats count by log_level </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
         <option name="charting.drilldown">all</option>
        <drilldown>

            <set token="sourcetype_tok">$click.value$</set>

       </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$sourcetype_tok$">
      <table>
        <title>$sourcetype_tok$</title>
        <search>
          <query> index=_internal log_level="$sourcetype_tok$"| stats count by log_level </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
      </panel>
    </row>
</dashboard>
0 Karma

Legend

By default, clicking on a chart will open a browser tab that displays the underlying events.
If that is not what you want, you can customize the drill-down behavior by adding the chart to a dashboard. Within a dashboard, there are a number of ways that you can customize.

The Splunk Dashboards Example app is free and shows excellent examples of drill-downs. I would install this app on a test machine or your personal copy of Splunk. It won't hurt anything, but it really doesn't belong in your production environment. You can download it here http://splunkbase.splunk.com/app/1603/

If you prefer to read the manual, the section on drill-downs appears here
http://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownIntro

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!