Splunk Search

Splunk pie chart drilldown to show all values for slices, in timechart by default when page loads ?

pgadhari
Builder

I have a pie chart drilldown wherein when I click on each slice, the drilldown panel shows the timechart for those events. By default, when the page loads the pie chart, the drill down panel shows message as "search is waiting for input", and then when I click on each slice of pie, it shows the timechart for that pie slice.

I want to show all the values of piechart slice in the timechart drilldown panel, when the page loads. After that, based on click of slice, that particular slice data should load. I do not want to use "row depends".

In the first image - it should show timechart for all slices by default when page loads, instead of showing "search is waiting for input" ?

Attaching screenshots for your reference. Please help to achieve this ?

alt text

alt text

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@pgadhari,

Set the token you are using to filter the drilldown to "*" using the init on page load.

Here is a run anywhere example

Updated: with display token

<dashboard>
  <label>Pie Chart Drilldown</label>
  <init>
    <set token="tok_value">*</set>
    <set token="display_token">All</set>
  </init>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal earliest=-15m|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="tok_value">$click.value$</set>
          <set token="display_token">$click.value$</set>

        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Timechart for $display_token$</title>
      <chart>
        <search>
          <query>index=_internal sourcetype=$tok_value$ earliest=-15m|timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</dashboard>

Note : If you are using same search in the drilldown, you can use base search and post processing.

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@pgadhari,

Set the token you are using to filter the drilldown to "*" using the init on page load.

Here is a run anywhere example

Updated: with display token

<dashboard>
  <label>Pie Chart Drilldown</label>
  <init>
    <set token="tok_value">*</set>
    <set token="display_token">All</set>
  </init>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal earliest=-15m|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="tok_value">$click.value$</set>
          <set token="display_token">$click.value$</set>

        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Timechart for $display_token$</title>
      <chart>
        <search>
          <query>index=_internal sourcetype=$tok_value$ earliest=-15m|timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</dashboard>

Note : If you are using same search in the drilldown, you can use base search and post processing.

Happy Splunking!
0 Karma

pgadhari
Builder

Thanks. It is working as expected. But when we display the token value in the Panel title, it shows as "*", would it be possible to give some name like "ALL" to it ? instead of showing "Timechart for *" ?

0 Karma

pgadhari
Builder

some how in my previous comment "/" is not visible ? I need to show "ALL" instead of star sign (/) in the panel title ?

0 Karma

pgadhari
Builder
in the panel title it shows "Timechart for *", instead of * sign, I want to show "Timechart for ALL", is that possible ?

Somehow in my previous comments star character is not getting displayed.
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@pgadhari,
easiest method is to add an additional token for display . Updated the answer , try and let me know

Happy Splunking!
0 Karma

pgadhari
Builder

Great this is working. Actually, last thing, I added a Month Timepicker to the page, wherein I have to show the events for that particular month like Nov-2019, Oct-2019 etc. Now the problem is when I change the Month, I want to reset the timechart panel to show all the pages instead of the pie clicked last time for that month. As of now, it is showing the last pie clicked values, unless I refresh the page.

I tried putting change condition for unsetting the "tok_value" token inside the time input, but somehow it is not working, as it is resetting the tok_value token itself and the panel is showing as "Waiting for input" . Please help ?

0 Karma

pgadhari
Builder

@renjith.nair - can you reply on my above comment please ? I want to reset the token, so that when I change the Month, it should show ALL events of the piechart ?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@pgadhari ,
Just set the token to * on the change event of your month input

  <fieldset submitButton="false">
    <input type="dropdown" token="token_month">
      <label>Month</label>
      <choice value="Nov-2019">Nov-2019</choice>
      <choice value="Oct-2019">Oct-2019</choice>
      <default>Nov-2019</default>
      <initialValue>Nov-2019</initialValue>
      <change>
        <set token="tok_value">*</set>
      </change>
    </input>
  </fieldset>

Here is the working example.

<form>
  <label>Pie Chart Drilldown</label>
  <init>
    <set token="tok_value">*</set>
    <set token="display_token">All</set>
  </init>
  <fieldset submitButton="false">
    <input type="dropdown" token="token_month">
      <label>Month</label>
      <choice value="Nov-2019">Nov-2019</choice>
      <choice value="Oct-2019">Oct-2019</choice>
      <default>Nov-2019</default>
      <initialValue>Nov-2019</initialValue>
      <change>
        <set token="tok_value">*</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Data for $token_month$</title>
      <chart>
        <search>
          <query>index=_internal earliest=-15m|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="tok_value">$click.value$</set>
          <set token="display_token">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Timechart for $display_token$</title>
      <chart>
        <search>
          <query>index=_internal sourcetype=$tok_value$ earliest=-15m|timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

Please do upvote/accept if its working for you.

Happy Splunking!
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...