Using colours Drill down option is not working?

[Abilan1]

Hi,

I have created a Dashboard (column chart) using Colours option and enabled drill down options as well. After creation, in the dashboard if i click on anything in chart, it is not drilling down. I have removed the colours from Dashboard, I can drill down now in that chart. Is "Add Colour" option is related to "Drilling Down" option?

[MuS]

Hi Abilan1,

No, the add colour option is not related to the drill down function. Take this run everywhere dashboard which includes one colour drill down panel and one non-colour drill down panel:

<dashboard>
  <label>click on color events</label>
  <row>
    <panel>
      <chart>
        <title>colour &amp; drill down</title>
        <search>
          <query>| pivot internal_server daily_usage sum(gb) AS "Sum of License Used (GB)" SPLITROW _time AS _time PERIOD auto SPLITCOL gb SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 0</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisTitleY.text">Sum of License Used (GB)</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>no colour &amp; drill down</title>
        <search>
          <query>| pivot internal_server daily_usage sum(gb) AS "Sum of License Used (GB)" SPLITROW _time AS _time PERIOD auto SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.legend.placement">none</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>
</dashboard>

Hope this helps ...

cheers, MuS

[aashish_122001]

Thanks Mus !!

[Abilan1]

Hi MuS,

Thank you so much for your help, do I need to merge this XML with my existing dashboard XML?

Regards,
Abilan

[MuS]

No, this is an example dashboard which uses the build in Splunk data model and not your data.

[Abilan1]

Hi MuS,

Yes. I have modified this XML according to my XML. My question here is, in the 1st Panel (which has colors) am not able to drill down from that. From the 2nd Panel (which doesn't have color) I can drill down. Please let me know how to drill down from the 1st panel which has colors?

Thank you again!!

[MuS]

make sure you have

<option name="charting.drilldown">all</option> 

set, that's all

[Abilan1]

Hi MuS,
yes, I have that in my XML. but still it is not drilling down.

[MuS]

So my run everywhere example from above works for you - right? And your Dashboard does not - right ? Did you delete it and create it from scratch again? There must be something wrong....

[Abilan1]

Hi MuS,

I have created the dashboard using your XML, I've only modified the query. I got the two Panel in the dashboard.
1. colour & drill down
2. no colour & drill down
In the 1st Panel, colour & drill down - I can see the bars in blue colour and I can drill it. How can I make those bars into different colours (each bar should have a unique colour) and drill down option should also be enabled in that.

[MuS]

In my first example the key to get the colours is the SPLITCOL gb option in the search

[Abilan1]

Hi,

Please find source XML of my dashboard.

Test1
Test for color

<panel>
  <chart>
    <title>Test</title>
    <search>
      <query>| pivot Test1 EventObject count(EventObject) AS "Count of Event Object" SPLITROW date_mday AS date_mday SPLITCOL date_mday SORT 100 date_mday ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 0</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisTitleY.text">Count of Event Object</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.chart">column</option>
  </chart>
</panel>

[Abilan1]

Hi ,

Can anyone help me on this?

[Abilan1]

Hi,

can anyone help me on this?

Thank you!

[alacercogitatus]

some code would be nice, thanks!

[Abilan1]

Hi,

Please find the source XML of my dashboard.

Test1
Test for color

<panel>
  <chart>
    <title>Test</title>
    <search>
      <query>| pivot Test1 EventObject count(EventObject) AS "Count of Event Object" SPLITROW date_mday AS date_mday SPLITCOL date_mday SORT 100 date_mday ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 0</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisTitleY.text">Count of Event Object</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.chart">column</option>
  </chart>
</panel>