Pie chat tokens modify output from input

[robertlynch2020]

Hi

I am displaying a pie chart from the data CLASS_Name + Method_Name, then a user clicks on the PIE chart i want to use only the CLASS_NAME to be set in the token (so the PIE chart will re-run). So i need to run an eval or something to split out the two and re-set the token. However i cant figure it out.

Below i can set the token TPS_Class_token to $row.fullyQualifiedMethod$ (CLASS_Name + Method_Name), but i need to get rid of the method name.
The REX is something like the following, but i am not sure where to applay it. rex field=$TPS_Class_token$ "(?P<CLASS>[^ ]*?)\s? ."

example of Class = limits.mlc.excesses.realtime.RealtimeExcessPublisher
example of method = read
=>fullyQualifiedMethod= limits.mlc.excesses.realtime.RealtimeExcessPublisher .read

  <chart>
    <title>TPS Time (Total Duration) Class = $TPS_Class_token$</title>
    <search>
      <query>index=mlc_live sourcetype=tps host=$host_token$ (user=* OR NOT user=*) NOT overflow=true | search name = $TPS_Class_token$ |  eval fullyQualifiedMethod = name." .".operationIdentity | eval duration = endTime - startTime | stats sum(duration) as Total_Duration(ms) by $CLASS_OR_METHOD$</query>
      <earliest>$tps_selection.earliest$</earliest>
      <latest>$tps_selection.latest$</latest>
    </search>
    <drilldown>
      <set token="TPS_Class_token">$row.fullyQualifiedMethod$</set>
    </drilldown>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">pie</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
    <option name="charting.legend.placement">right</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">0</option>
    <option name="dataOverlayMode">none</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
  </chart>
</panel>

[sundareshr]

I have never tried drill-down to the same panel. But it is an interesting concept. If you have the option, change the delim between CLASS & METHOD to something more unique (say #). You can then try <set token="TPS_Class_token">mvindex(split($row.fullyQualifiedMethod$, "#"). 0)</set>

[sundareshr]

@robertlynch2020, try this test dashboard. Should work as-is

<form>
  <label>Test Dashboard</label>
  <fieldset submitButton="false">
    <input type="time" token="timepicker" searchWhenChanged="true">
      <label>Timepicker</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
      <change>
        <set token="val">*</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype="$val$"  | eval st=sourcetype."#".source | eval x="$val$" | eval s=mvindex(split(st, "#"), 0) | stats count by s</query>
          <earliest>$timepicker.earliest$</earliest>
          <latest>$timepicker.latest$</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">false</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <option name="wrap">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <eval token="val">mvindex(split($row.s$, "#"), 0)</eval>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

[robertlynch2020]

Cheers 🙂 This worked. Good man...

[sundareshr]

Awesome. Please mark answered to close it out. Thanks

[robertlynch2020]

Hi - Thanks for this, i think i am very close. I have done what you said and added in the #. However the token is been set to mvindex(split(limits.mlc.excesses.batch.DefaultBatchExcessEventConsumer #run, "#"). 0) and not value. limits.mlc.excesses.batch.DefaultBatchExcessEventConsumer

So i tried to add in eval, however that did not have any effect.
mvindex(split($row.fullyQualifiedMethod$, "#"). 0)

Then i tried , but this just opens a new search screen.

mvindex(split($row.fullyQualifiedMethod$, "#"). 0)

[somesoni2]

Use eval instead of set

mvindex(split("$row.fullyQualifiedMethod$", "#"). 0)

[robertlynch2020]

Hi - Thanks, but i have tried eval and no good, noting updates. I am not sure if it is because i am in drilldown of a pie chat that it wont evel. Any other ideas?

mvindex(split($row.fullyQualifiedMethod$, "#"). 0)