Splunk Search

Can we disable the drilldown for a specific field in pie chart?

Priya312
Explorer

I have a pie chart which displays two things
1) ABC
2)XYZ

When I click on ABC, it should go to other Dashboard via drilldown. I am able to do this by providing the link.

But, when a person clicks on XYZ, it should not take any action. Even drill down to search Window is also not to be there.

I am using Splunk version 6.6.5

I have tried a couple of ways to achieve my requirement but I couldn't achieve it. I have provided those examples below:

method 1)

<condition match="match('click.value',&quot;XYZ&quot;)">
<link>qwerty.com</link>
</condition>
   <condition match="match('click.value',&quot;ABC&quot;)">
            <link></link>
</condition>

method 2)

<condition field="XYZ">
            <link>qwerty.com</link>
          </condition>
          <condition field="ABC">
             </condition>

Thank You in advance

Tags (4)
0 Karma
1 Solution

niketnilay
Legend

@Priya312, if the requirement is for Click to a new page for after clicking on one slice (i.e. ABC) and disable any action on click of other slice (i.e. XYZ), you should try the following code:

    <drilldown>
      <condition match="$click.value$==&quot;ABC&quot;">
        <!-- DRILLDOWN TO NEW PAGE WHEN ABC SLICE IS CLICKED-->
        <link target="_blank">https://www.google.com/search?q=$click.value$</link>
        <!-- SINCE ABOVE DRILLDOWN IS FOR ABC INSTEAD OF $click.value$ ABC CAN ALSO BE USED-->
      </condition>
      <condition>
        <!-- Leaving condition block empty treats it as default else case. 
               However, match="$click.value$==&quot;XYZ&quot;" can also be used -->
        <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED i.e. XYZ-->
      </condition>
    </drilldown>

Following is a run anywhere example, based on Splunk's _internal index which plots two slices WARN and ERROR. Drilldown for WANR opens a new link and that on ERROR does not do anything:

<form>
  <label>Pie Chart disable Drilldown for specific slice</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <title>$tokSet$| $tokSetLink$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level IN ("WARN","ERROR")
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$click.value$==&quot;WARN&quot;">
            <!-- DRILLDOWN TO NEW PAGE WHEN WARN IS CLICKED-->
            <link target="_blank">https://www.google.com/search?q=$click.value$</link>
          </condition>
          <condition>
            <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED-->
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketnilay
Legend

@Priya312, if the requirement is for Click to a new page for after clicking on one slice (i.e. ABC) and disable any action on click of other slice (i.e. XYZ), you should try the following code:

    <drilldown>
      <condition match="$click.value$==&quot;ABC&quot;">
        <!-- DRILLDOWN TO NEW PAGE WHEN ABC SLICE IS CLICKED-->
        <link target="_blank">https://www.google.com/search?q=$click.value$</link>
        <!-- SINCE ABOVE DRILLDOWN IS FOR ABC INSTEAD OF $click.value$ ABC CAN ALSO BE USED-->
      </condition>
      <condition>
        <!-- Leaving condition block empty treats it as default else case. 
               However, match="$click.value$==&quot;XYZ&quot;" can also be used -->
        <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED i.e. XYZ-->
      </condition>
    </drilldown>

Following is a run anywhere example, based on Splunk's _internal index which plots two slices WARN and ERROR. Drilldown for WANR opens a new link and that on ERROR does not do anything:

<form>
  <label>Pie Chart disable Drilldown for specific slice</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <title>$tokSet$| $tokSetLink$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level IN ("WARN","ERROR")
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$click.value$==&quot;WARN&quot;">
            <!-- DRILLDOWN TO NEW PAGE WHEN WARN IS CLICKED-->
            <link target="_blank">https://www.google.com/search?q=$click.value$</link>
          </condition>
          <condition>
            <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED-->
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Priya312
Explorer

Tq so much Niketnilay.It worked.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Priya312,

Can you please change match in your drilldown code?

If I want to match ABC with clicked value then code is

<condition match="'click.value'=&quot;ABC&quot;">

If I want to match XYZ with clicked value then code is

<condition match="'click.value'=&quot;XYZ&quot;">

My Sample code:

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <title>$A$ $B$</title>
      <chart>
        <search>
          <query>| makeresults | eval A="ABC,XYZ",A=split(A,",") | stats count by A</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <condition match="'click.value'=&quot;ABC&quot;">
            <set token="A">$click.value$</set>
            <set token="B">AXXXXXXXXX</set>
          </condition>
          <condition>
            <set token="A">$click.value$</set>
            <set token="B">BBBBBBBBBBB</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...