Splunk Search

Pie Chart with count+ DrillDown with click.value and replace

saravana22
Explorer

https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html

same as above post, would like to have a pie chart with its count, so followed the post and its work, it can show the Count in Pie Chart

... |stats count by sc_status
|eval status_slice =sc_status+" - count:"+count

 

Beside, we still have a token to Pass the sc_status as 404/500/304... to customised search string in drilldown

unfortunately, it's now passing sc_status as 304 - count:21088 instead of passing 304 to dilldown to search we click on it, which cause the search not working.

<drilldown>
<eval token="test">replace('click.value',"(\?&lt;=\d\d\d)(\?s)(.*\$)","")</eval>

</drilldown>

in drill down its not replacing the value as expexted

would like to seek any way can fulfill both requirements ( Show Count in Pie Chart + Pass the correct Value to customised search)

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<drilldown>
<eval token="test">mvindex(split($click.value$," "),0)</eval>
</drilldown>

View solution in original post

0 Karma

saravana22
Explorer

@ITWhisperer : its worked well... Thank you so much for quick help 🙂

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!