Dashboards & Visualizations

Using colours Drill down option is not working?

Abilan1
Path Finder

Hi,

I have created a Dashboard (column chart) using Colours option and enabled drill down options as well. After creation, in the dashboard if i click on anything in chart, it is not drilling down. I have removed the colours from Dashboard, I can drill down now in that chart. Is "Add Colour" option is related to "Drilling Down" option?

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Abilan1,

No, the add colour option is not related to the drill down function. Take this run everywhere dashboard which includes one colour drill down panel and one non-colour drill down panel:

<dashboard>
  <label>click on color events</label>
  <row>
    <panel>
      <chart>
        <title>colour &amp; drill down</title>
        <search>
          <query>| pivot internal_server daily_usage sum(gb) AS "Sum of License Used (GB)" SPLITROW _time AS _time PERIOD auto SPLITCOL gb SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 0</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisTitleY.text">Sum of License Used (GB)</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>no colour &amp; drill down</title>
        <search>
          <query>| pivot internal_server daily_usage sum(gb) AS "Sum of License Used (GB)" SPLITROW _time AS _time PERIOD auto SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.legend.placement">none</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>
</dashboard>

Hope this helps ...

cheers, MuS

aashish_122001
Explorer

Thanks Mus !!

0 Karma

Abilan1
Path Finder

Hi MuS,

Thank you so much for your help, do I need to merge this XML with my existing dashboard XML?

Regards,
Abilan

0 Karma

MuS
SplunkTrust
SplunkTrust

No, this is an example dashboard which uses the build in Splunk data model and not your data.

0 Karma

Abilan1
Path Finder

Hi MuS,

Yes. I have modified this XML according to my XML. My question here is, in the 1st Panel (which has colors) am not able to drill down from that. From the 2nd Panel (which doesn't have color) I can drill down. Please let me know how to drill down from the 1st panel which has colors?

Thank you again!!

0 Karma

MuS
SplunkTrust
SplunkTrust

make sure you have

<option name="charting.drilldown">all</option> 

set, that's all

0 Karma

Abilan1
Path Finder

Hi MuS,
yes, I have that in my XML. but still it is not drilling down.

0 Karma

MuS
SplunkTrust
SplunkTrust

So my run everywhere example from above works for you - right? And your Dashboard does not - right ? Did you delete it and create it from scratch again? There must be something wrong....

0 Karma

Abilan1
Path Finder

Hi MuS,

I have created the dashboard using your XML, I've only modified the query. I got the two Panel in the dashboard.
1. colour & drill down
2. no colour & drill down
In the 1st Panel, colour & drill down - I can see the bars in blue colour and I can drill it. How can I make those bars into different colours (each bar should have a unique colour) and drill down option should also be enabled in that.

0 Karma

MuS
SplunkTrust
SplunkTrust

In my first example the key to get the colours is the SPLITCOL gb option in the search

0 Karma

Abilan1
Path Finder

Hi,

Please find source XML of my dashboard.

Test1
Test for color

<panel>
  <chart>
    <title>Test</title>
    <search>
      <query>| pivot Test1 EventObject count(EventObject) AS "Count of Event Object" SPLITROW date_mday AS date_mday SPLITCOL date_mday SORT 100 date_mday ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 0</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisTitleY.text">Count of Event Object</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.chart">column</option>
  </chart>
</panel>
0 Karma

Abilan1
Path Finder

Hi ,

Can anyone help me on this?

0 Karma

Abilan1
Path Finder

Hi,

can anyone help me on this?

Thank you!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

some code would be nice, thanks!

Abilan1
Path Finder

Hi,

Please find the source XML of my dashboard.

Test1
Test for color

<panel>
  <chart>
    <title>Test</title>
    <search>
      <query>| pivot Test1 EventObject count(EventObject) AS "Count of Event Object" SPLITROW date_mday AS date_mday SPLITCOL date_mday SORT 100 date_mday ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 0</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisTitleY.text">Count of Event Object</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.chart">column</option>
  </chart>
</panel>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...