Splunk Search

Can we disable the drilldown for a specific field in pie chart?

Priya312
Explorer

I have a pie chart which displays two things
1) ABC
2)XYZ

When I click on ABC, it should go to other Dashboard via drilldown. I am able to do this by providing the link.

But, when a person clicks on XYZ, it should not take any action. Even drill down to search Window is also not to be there.

I am using Splunk version 6.6.5

I have tried a couple of ways to achieve my requirement but I couldn't achieve it. I have provided those examples below:

method 1)

<condition match="match('click.value',&quot;XYZ&quot;)">
<link>qwerty.com</link>
</condition>
   <condition match="match('click.value',&quot;ABC&quot;)">
            <link></link>
</condition>

method 2)

<condition field="XYZ">
            <link>qwerty.com</link>
          </condition>
          <condition field="ABC">
             </condition>

Thank You in advance

Tags (4)
0 Karma
1 Solution

niketn
Legend

@Priya312, if the requirement is for Click to a new page for after clicking on one slice (i.e. ABC) and disable any action on click of other slice (i.e. XYZ), you should try the following code:

    <drilldown>
      <condition match="$click.value$==&quot;ABC&quot;">
        <!-- DRILLDOWN TO NEW PAGE WHEN ABC SLICE IS CLICKED-->
        <link target="_blank">https://www.google.com/search?q=$click.value$</link>
        <!-- SINCE ABOVE DRILLDOWN IS FOR ABC INSTEAD OF $click.value$ ABC CAN ALSO BE USED-->
      </condition>
      <condition>
        <!-- Leaving condition block empty treats it as default else case. 
               However, match="$click.value$==&quot;XYZ&quot;" can also be used -->
        <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED i.e. XYZ-->
      </condition>
    </drilldown>

Following is a run anywhere example, based on Splunk's _internal index which plots two slices WARN and ERROR. Drilldown for WANR opens a new link and that on ERROR does not do anything:

<form>
  <label>Pie Chart disable Drilldown for specific slice</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <title>$tokSet$| $tokSetLink$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level IN ("WARN","ERROR")
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$click.value$==&quot;WARN&quot;">
            <!-- DRILLDOWN TO NEW PAGE WHEN WARN IS CLICKED-->
            <link target="_blank">https://www.google.com/search?q=$click.value$</link>
          </condition>
          <condition>
            <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED-->
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Priya312, if the requirement is for Click to a new page for after clicking on one slice (i.e. ABC) and disable any action on click of other slice (i.e. XYZ), you should try the following code:

    <drilldown>
      <condition match="$click.value$==&quot;ABC&quot;">
        <!-- DRILLDOWN TO NEW PAGE WHEN ABC SLICE IS CLICKED-->
        <link target="_blank">https://www.google.com/search?q=$click.value$</link>
        <!-- SINCE ABOVE DRILLDOWN IS FOR ABC INSTEAD OF $click.value$ ABC CAN ALSO BE USED-->
      </condition>
      <condition>
        <!-- Leaving condition block empty treats it as default else case. 
               However, match="$click.value$==&quot;XYZ&quot;" can also be used -->
        <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED i.e. XYZ-->
      </condition>
    </drilldown>

Following is a run anywhere example, based on Splunk's _internal index which plots two slices WARN and ERROR. Drilldown for WANR opens a new link and that on ERROR does not do anything:

<form>
  <label>Pie Chart disable Drilldown for specific slice</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <title>$tokSet$| $tokSetLink$</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level IN ("WARN","ERROR")
| stats count by log_level</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$click.value$==&quot;WARN&quot;">
            <!-- DRILLDOWN TO NEW PAGE WHEN WARN IS CLICKED-->
            <link target="_blank">https://www.google.com/search?q=$click.value$</link>
          </condition>
          <condition>
            <!-- DO NOTHING WHEN ANYTHING ELSE IS CLICKED-->
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Priya312
Explorer

Tq so much Niketnilay.It worked.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Priya312,

Can you please change match in your drilldown code?

If I want to match ABC with clicked value then code is

<condition match="'click.value'=&quot;ABC&quot;">

If I want to match XYZ with clicked value then code is

<condition match="'click.value'=&quot;XYZ&quot;">

My Sample code:

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <title>$A$ $B$</title>
      <chart>
        <search>
          <query>| makeresults | eval A="ABC,XYZ",A=split(A,",") | stats count by A</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <condition match="'click.value'=&quot;ABC&quot;">
            <set token="A">$click.value$</set>
            <set token="B">AXXXXXXXXX</set>
          </condition>
          <condition>
            <set token="A">$click.value$</set>
            <set token="B">BBBBBBBBBBB</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...