Splunk Search

Pie Chart with count+ DrillDown with click.value and replace

saravana22
Explorer

https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html

same as above post, would like to have a pie chart with its count, so followed the post and its work, it can show the Count in Pie Chart

... |stats count by sc_status
|eval status_slice =sc_status+" - count:"+count

 

Beside, we still have a token to Pass the sc_status as 404/500/304... to customised search string in drilldown

unfortunately, it's now passing sc_status as 304 - count:21088 instead of passing 304 to dilldown to search we click on it, which cause the search not working.

<drilldown>
<eval token="test">replace('click.value',"(\?&lt;=\d\d\d)(\?s)(.*\$)","")</eval>

</drilldown>

in drill down its not replacing the value as expexted

would like to seek any way can fulfill both requirements ( Show Count in Pie Chart + Pass the correct Value to customised search)

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>
0 Karma

saravana22
Explorer

@ITWhisperer : its worked well... Thank you so much for quick help 🙂

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...