Splunk Search
Highlighted

How to create a drilldown from several pie charts in Dashboard1 to the same single table in Dashboard2?

Communicator

I have several pie charts. I would like to drilldown from each of the pie charts
to the same table in a different view page.

So far I am able to drilldown any value of the piechart to separate tables in the other
page. But to save space, I would like to drilldown to the same table. I am trying
this conditional OR statement, but it seems not to work. Is it the case that
for the search to work, all the tokens in the search should have a value
assigned to it? How to assign a default value to a token? or do I have to use
some eval statement here?

This is the PieChart in View 1 (Similarly I have several other piecharts)

<chart>
      <title>Traffic Locations</title>
        <searchString>index=location source=traffic_locations | fields state_name | top 20 state_name</searchString>
     <option name="charting.chart">pie</option>
        <option name="maxResultCount">200000</option>   

   <drilldown>
    <!--<set token="state_name">$click.value$</set>-->
          <link>
           <![CDATA[
        /app/myapp/myview1_2?form.state_name=$click.value$
            ]]>
           </link>
     </drilldown>

    </chart>

This is search for the table in View 2

 <row>
    <panel>

      <table>
        <search>
          <query>index=location source=traffic_locations 
                | search * (state_name=$form.state_name$ OR zip_code=$form.zip_code$)  <!-- This doesnt work! -->
                | table location, state_name, zip_code, address, quantity  
                | sort by state_name</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumber">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">20</option>
        <option name="rowNumbers">false</option>
      </table>
   </panel>
   </row>

Please help. Thanks in advance.

0 Karma
Highlighted

Re: How to create a drilldown from several pie charts in Dashboard1 to the same single table in Dashboard2?

Legend

Try removing the * after search command.

0 Karma
Highlighted

Re: How to create a drilldown from several pie charts in Dashboard1 to the same single table in Dashboard2?

Communicator

That doesnt work. "Search is waiting for input.."

0 Karma
Highlighted

Re: How to create a drilldown from several pie charts in Dashboard1 to the same single table in Dashboard2?

SplunkTrust
SplunkTrust

Do different pie chart provides different values/token to your drilldown dashboard/panel?

0 Karma
Highlighted

Re: How to create a drilldown from several pie charts in Dashboard1 to the same single table in Dashboard2?

Communicator

Yes, the piecharts shows different columns of the same table in the drilldown.

For the drilldown I have for piechart1

/app/myapp/myview12?form.statename=$click.value$

and then for another piechart

/app/myapp/myview12?form.zipcode=$click.value$

similarly several more

0 Karma
Highlighted

Re: How to create a drilldown from several pie charts in Dashboard1 to the same single table in Dashboard2?

Splunk Employee
Splunk Employee

2 things:

1) You are only passing state_name to view 2.

2) For performance, your search in view 2 should be:

index=location source=traffic_locations (state_name=$form.state_name$ OR zip_code=$form.zip_code$) | table location, state_name, zip_code, address, quantity | sort by state_name
Highlighted

Re: How to create a drilldown from several pie charts in Dashboard1 to the same single table in Dashboard2?

SplunkTrust
SplunkTrust

Based on your example, for two panels in dashboard 1, statename pie chart and zipcode pie chart, use following as drilldown URL. Basically make sure each drilldown is passing values to all tokens used in your drilldown table search, with default value as *.

state_name pie chart

<link>
            <![CDATA[
         /app/myapp/myview1_2?form.state_name=$click.value$&for.zip_code=*
             ]]>
</link>

zip_code pie chart

<link>
            <![CDATA[
         /app/myapp/myview1_2?form.state_name=*&for.zip_code=$click.value$
             ]]>
</link>
Highlighted

Re: How to create a drilldown from several pie charts in Dashboard1 to the same single table in Dashboard2?

Communicator

Your Awesome!

I also had to change
(statename=$form.statename$ AND zipcode=$form.zipcode$)
from OR to AND.

This makes sense, but now I need to pass default value for all the other piecharts.

0 Karma