Splunk pie chart drilldown

[vik123ash]

Hi All,

Please help me here.

I have created a dashboard with 1 pie chart . The pie chart has 4-5 sectors. Is it possible to click on each sector and after clicking on each sector a new webpage will open that includes details for each individual sector?

Could you please advise?

Vikash

[kamlesh_vaghela · Accepted solution]

HI
Can you try drilldown from below dashaboard code??

<dashboard>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal  | stats  count by component</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal component=$click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>
        </drilldown>
      </chart>
    </panel>
  </row>
</dashboard>

Thanks

[vik123ash]

Thanks Kamalesh.

i can see that after clicking on each sector it is searching in search for that specific sector.

is it possible that if i click on any sector it opens hardcoded link i have created for each sector.

Suppose my sector name is A, it will open link for A and if i click on Sector B, it opens link for B. if there are 10 sectors , i want to hardcode separate link for each sector.

[kamlesh_vaghela]

HI

Few changes in drilldown.

<drilldown>
          <condition match="match('click.value',&quot;A&quot;)">
            <link target="_blank">search?q=index=_internal $click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>  
          </condition>
          <condition match="match('click.value',&quot;B&quot;)">
            <link target="_blank">search?q=index=_internal $click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>  
          </condition>
          <condition match="match('click.value',&quot;C&quot;)">
            <link target="_blank">search?q=index=_internal $click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>  
          </condition>
          <condition>
            <link target="_blank">search?q=index=_internal component=$click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>  
          </condition>

        </drilldown>

Just change drilldown logic as per your requirement.

thanks

[vik123ash]

Thanks a lot. it was superb.

1 more help please.

I am drilling down like this and its working. Time Range i selected for the first chart, i want to carry forward the same time Range in the Drilled down page also. Could you please advise.

For example i have selected 7 days time Range in Parent graph, and once i click on any of the sector it should also show same Time Range in second graph.

       <condition match="match('click.value',&quot;A&quot;)">
         <link target="_blank">https://abcde.com</link>  
                    </condition>

[niketn]

@vik123ash, I think @kamlesh_vaghela has already answered that in his previous comment.

If the Time Picker input in destination dashboard is tokTimeDest and that in the source is tokTimeSrc (You can have both Time Picker input tokens same for ease, I have just named them separate to draw out the distinction in the code)

<link target="_blank">search?q=index=_internal $click.value$&amp;form.tokTimeDes.earliest=$tokTimeSrc.earliest$&amp;form.tokTimeDes.=$tokTimeSrc.latest$</link>

And similarly for other condition blocks. Please try out and confirm.

Also ideally you should be creating a separate question once your original question has been answered to your satisfaction. I would request you to up vote Answer and all the comments from Kamlesh which have assisted you so far.

[vik123ash]

Thanks a lot @kamlesh_vaghela & @Niketnilay.

it worked.

i am new to this page. was not aware much things. I will follow all guidelines from next times.

Thanks a lot to you guys.

[niketn]

@vik123ash, dont worry this is not a guideline, more of a recommendation 🙂 Splunk Community Members tend to pick up on Unanswered questions, so if you keep raising followup questions in the same thread it would be mostly up to only the one who responded to you (or those who are already following the question).

If you want to know the guidelines, here they are: https://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/Splunkcommunityguidelines

I feel all your questions have been answered in the thread so please go ahead and accept the same as answered. Also do up vote (hover over answer/comment and click the up arrow to up vote) all the comments that have helped.

[vik123ash]

Thank you.

[kamlesh_vaghela]

HI guys,
can we mark this question closed?
Thanks.

[vik123ash]

yes please.