Pie Chart with count+ DrillDown with click.value and replace

[saravana22]

https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html

same as above post, would like to have a pie chart with its count, so followed the post and its work, it can show the Count in Pie Chart

... |stats count by sc_status
|eval status_slice =sc_status+" - count:"+count

Beside, we still have a token to Pass the sc_status as 404/500/304... to customised search string in drilldown

unfortunately, it's now passing sc_status as 304 - count:21088 instead of passing 304 to dilldown to search we click on it, which cause the search not working.

<drilldown>
<eval token="test">replace('click.value',"(\?&lt;=\d\d\d)(\?s)(.*\$)","")</eval>

</drilldown>

in drill down its not replacing the value as expexted

would like to seek any way can fulfill both requirements ( Show Count in Pie Chart + Pass the correct Value to customised search)

[ITWhisperer · Accepted solution]

Try something like this

<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>

[saravana22]

@ITWhisperer : its worked well... Thank you so much for quick help 🙂