https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html
same as above post, would like to have a pie chart with its count, so followed the post and its work, it can show the Count in Pie Chart
... |stats count by sc_status |eval status_slice =sc_status+" - count:"+count |
Beside, we still have a token to Pass the sc_status as 404/500/304... to customised search string in drilldown
unfortunately, it's now passing sc_status as 304 - count:21088 instead of passing 304 to dilldown to search we click on it, which cause the search not working.
<drilldown> </drilldown> |
in drill down its not replacing the value as expexted
would like to seek any way can fulfill both requirements ( Show Count in Pie Chart + Pass the correct Value to customised search)
Try something like this
<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>
Try something like this
<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>
@ITWhisperer : its worked well... Thank you so much for quick help 🙂