How to show the sum in a new chart just by moving over a pie chart widget?

[rahhali22]

Hello,

I'd like to create 2 charts: a pie and a unique value, and when I'm moving over a pie widget, I want to display the total in a chart unique value.

I wonder if it's possible or not to connect the 2 charts

[somesoni2]

In that case you can see the example named "In-Page Drilldown with Perma-linking" in the Splunk 6.x Dashboard example app under Drilldown Element examples. This gives similar example where user can click on first visualization, take the value from clicked element and show/run another visualization with a search using clicked element value. The app can be found here https://splunkbase.splunk.com/app/1603/

Mouse hover action is not available by default and will require some custom JS.

In case you can't download/install it right away, here is the runanywhere code from that app for the example I want you to look.

<form>
    <label>In-Page Drilldown with Perma-linking</label>
    <fieldset submitButton="false">
        <!--
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
         -->
        <input type="text" token="sourcetype" searchWhenChanged="true" />
    </fieldset>
    <row>
        <table id="master">
            <title>Master</title>
            <searchString>index=_internal | stats count by sourcetype</searchString>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
            <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
            <option name="drilldown">row</option>
            <drilldown>
                <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
                <set token="sourcetype">$row.sourcetype$</set>
                <!-- If we also set the form.sourcetype the input will get updated too -->
                <set token="form.sourcetype">$row.sourcetype$</set>
            </drilldown>
        </table>
    </row>
    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <chart id="detail" depends="$sourcetype$">
            <title>Detail: $sourcetype$</title>
            <searchTemplate>index=_internal sourcetype=$sourcetype$ | timechart count</searchTemplate>
            <earliestTime>-60m@m</earliestTime>
            <latestTime>now</latestTime>
        </chart>
    </row>
</form>

[rahhali22]

Oh Thanks,
that's helpful 🙂

[lvetter]

You can change the drilldown elements in a visualization, when editing a visualization, you can also choose to "Show Data values". If you want to know more about those, you should download the "Splunk 6.x Dashboard Examples" app for good examples.

But if that doesn't do what you need, you'll have to work with javascript to get it done. For a starting point, look at the Dashboard Examples app, specifically Table Icon Set (Rangemap). Then if you are feeling up to it, you can look here: http://dev.splunk.com/webframework

[somesoni2]

Not sure I clearly get what you want. Do you want to have a pie chart and on click of a slice in the pie chart you want to show another chart??

[hartfoml]

Isn't there a way to put the count in each of the pie chart wedges? Wouldn't that be easier to do than to click to run a drill down search to create a new Unique value chart

[rahhali22]

Yeah, exactly or just by moving the mouse over a slice in the pie