Dashboards & Visualizations

Pie chat tokens modify output from input

robertlynch2020
Influencer

Hi

I am displaying a pie chart from the data CLASS_Name + Method_Name, then a user clicks on the PIE chart i want to use only the CLASS_NAME to be set in the token (so the PIE chart will re-run). So i need to run an eval or something to split out the two and re-set the token. However i cant figure it out.

Below i can set the token TPS_Class_token to $row.fullyQualifiedMethod$ (CLASS_Name + Method_Name), but i need to get rid of the method name.
The REX is something like the following, but i am not sure where to applay it. rex field=$TPS_Class_token$ "(?P<CLASS>[^ ]*?)\s? ."

example of Class = limits.mlc.excesses.realtime.RealtimeExcessPublisher
example of method = read
=>fullyQualifiedMethod= limits.mlc.excesses.realtime.RealtimeExcessPublisher .read

  <chart>
    <title>TPS Time (Total Duration) Class = $TPS_Class_token$</title>
    <search>
      <query>index=mlc_live sourcetype=tps host=$host_token$ (user=* OR NOT user=*) NOT overflow=true | search name = $TPS_Class_token$ |  eval fullyQualifiedMethod = name." .".operationIdentity | eval duration = endTime - startTime | stats sum(duration) as Total_Duration(ms) by $CLASS_OR_METHOD$</query>
      <earliest>$tps_selection.earliest$</earliest>
      <latest>$tps_selection.latest$</latest>
    </search>
    <drilldown>
      <set token="TPS_Class_token">$row.fullyQualifiedMethod$</set>
    </drilldown>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">pie</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
    <option name="charting.legend.placement">right</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">0</option>
    <option name="dataOverlayMode">none</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
  </chart>
</panel>
Tags (1)
0 Karma

sundareshr
Legend

I have never tried drill-down to the same panel. But it is an interesting concept. If you have the option, change the delim between CLASS & METHOD to something more unique (say #). You can then try <set token="TPS_Class_token">mvindex(split($row.fullyQualifiedMethod$, "#"). 0)</set>

sundareshr
Legend

@robertlynch2020, try this test dashboard. Should work as-is

<form>
  <label>Test Dashboard</label>
  <fieldset submitButton="false">
    <input type="time" token="timepicker" searchWhenChanged="true">
      <label>Timepicker</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
      <change>
        <set token="val">*</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype="$val$"  | eval st=sourcetype."#".source | eval x="$val$" | eval s=mvindex(split(st, "#"), 0) | stats count by s</query>
          <earliest>$timepicker.earliest$</earliest>
          <latest>$timepicker.latest$</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">false</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <option name="wrap">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <eval token="val">mvindex(split($row.s$, "#"), 0)</eval>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>

robertlynch2020
Influencer

Cheers :slightly_smiling_face: This worked. Good man...

0 Karma

sundareshr
Legend

Awesome. Please mark answered to close it out. Thanks

0 Karma

robertlynch2020
Influencer

Hi - Thanks for this, i think i am very close. I have done what you said and added in the #. However the token is been set to mvindex(split(limits.mlc.excesses.batch.DefaultBatchExcessEventConsumer #run, "#"). 0) and not value. limits.mlc.excesses.batch.DefaultBatchExcessEventConsumer

So i tried to add in eval, however that did not have any effect.
mvindex(split($row.fullyQualifiedMethod$, "#"). 0)

Then i tried , but this just opens a new search screen.

mvindex(split($row.fullyQualifiedMethod$, "#"). 0)

0 Karma

somesoni2
Revered Legend

Use eval instead of set

mvindex(split("$row.fullyQualifiedMethod$", "#"). 0)

0 Karma

robertlynch2020
Influencer

Hi - Thanks, but i have tried eval and no good, noting updates. I am not sure if it is because i am in drilldown of a pie chat that it wont evel. Any other ideas?

mvindex(split($row.fullyQualifiedMethod$, "#"). 0)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...