Splunk Search

Pie Chart with count+ DrillDown with click.value and replace

saravana22
Explorer

https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html

same as above post, would like to have a pie chart with its count, so followed the post and its work, it can show the Count in Pie Chart

... |stats count by sc_status
|eval status_slice =sc_status+" - count:"+count

 

Beside, we still have a token to Pass the sc_status as 404/500/304... to customised search string in drilldown

unfortunately, it's now passing sc_status as 304 - count:21088 instead of passing 304 to dilldown to search we click on it, which cause the search not working.

<drilldown>
<eval token="test">replace('click.value',"(\?&lt;=\d\d\d)(\?s)(.*\$)","")</eval>

</drilldown>

in drill down its not replacing the value as expexted

would like to seek any way can fulfill both requirements ( Show Count in Pie Chart + Pass the correct Value to customised search)

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>
0 Karma

saravana22
Explorer

@ITWhisperer : its worked well... Thank you so much for quick help 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...