Splunk Search

Pie Chart with count+ DrillDown with click.value and replace

saravana22
Explorer

https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html

same as above post, would like to have a pie chart with its count, so followed the post and its work, it can show the Count in Pie Chart

... |stats count by sc_status
|eval status_slice =sc_status+" - count:"+count

 

Beside, we still have a token to Pass the sc_status as 404/500/304... to customised search string in drilldown

unfortunately, it's now passing sc_status as 304 - count:21088 instead of passing 304 to dilldown to search we click on it, which cause the search not working.

<drilldown>
<eval token="test">replace('click.value',"(\?&lt;=\d\d\d)(\?s)(.*\$)","")</eval>

</drilldown>

in drill down its not replacing the value as expexted

would like to seek any way can fulfill both requirements ( Show Count in Pie Chart + Pass the correct Value to customised search)

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>
0 Karma

saravana22
Explorer

@ITWhisperer : its worked well... Thank you so much for quick help 🙂

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...