I have a search by which I am creating a pie chart.. I want to create it in such a way that when I select/click one of its sector it should show another pie chart with the values/fields in the hierarchy of that sector? how to do that? is it possible to create two pie charts of that sort?
are you looking for something similar to
<dashboard>
<label>Pie Chart</label>
<row>
<panel>
<chart>
<search>
<query>index=_*|stats count by index</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<drilldown>
<set token="index">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel depends="$index$">
<title>Sourcetypes for "$index$"</title>
<chart>
<search>
<query>index=$index$|stats count by sourcetype</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
</dashboard>
Can I get help with the help of an example?
Read through https://docs.splunk.com/Documentation/Splunk/8.0.6/Viz/DrilldownIntro
You will get what you need now and in future