Thanks for reply sir,
yestaday i found this app and i success to create
my XML is
searchtry
<!--
Create an input to store the drilldown value. It will be hidden using custom javascript when
the dashboard is loaded.
-->
<input type="text" token="MarcName" searchWhenChanged="true"></input>
<title>Master</title>
<searchString>index=newpwm source="SOCK_20150327_192217.log" | eval GG=substr(Msg,1,5) |eval MarcName=if((GG=="ARL E" OR GG=="QRL E"),substr(Msg, 27,5),substr(Msg, 26,5)) |stats count(MarcName) as numviewed by MarcName</searchString>
<earliestTime></earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<!-- Use set to specify the new token to be created.
Use any token from the page or from the click event to produce the value needed. -->
<set token="MarcName">$row.MarcName$</set>
<!-- If we also set the form.sourcetype the input will get updated too -->
<set token="form.MarcName">$row.MarcName$</set>
</drilldown>
</chart>
<!-- depends is the way we tell the content to only show when the token has a value.
Hint: use comma separated values if the element requires more than one token. -->
<chart id="detail" depends="$MarcName$">
<title>Detail: $MarcName$</title>
<search>
<query>index=newpwm source="SOCK_20150327_192217.log" | eval GG=substr(Msg,1,5)|eval MarcName=if((GG=="ARL E" OR GG=="QRL E"),substr(Msg, 27,5),substr(Msg, 26,5)) | eval ll=substr(Msg,0,7) |search MarcName=$MarcName$ |eval tran=if(ll="QRLNP72","refReq",if(ll="ARLNP72","refRes",if(ll="QRL E04","save","other")))| stats count(MarcName) as numviewed by tran</query>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
<option name="charting.legend.placement">right</option>
</chart>
<!-- depends is the way we tell the content to only show when the token has a value.
Hint: use comma separated values if the element requires more than one token. -->
<chart id="detai" depends="$MarcName$">
<title>Detail: $MarcName$</title>
<search>
<query>index=newpwm source="SOCK_20150327_192217.log" Msg="QRL E04*" |eval MarcName=substr(Msg, 27,5) |search MarcName=$MarcName$ |eval uu=substr(Msg,32,12) |join uu [search index=newpwm source="SOCK_20150327_192217.log" Msg=ARLNL* OR Msg=ARLNA* | eval ll=substr(Msg,0,7)|eval uu=if(ll=="ARLNL72",substr(Msg,299,12),substr(Msg,315,12))] | eval ll=substr(Msg,0,7) |eval tran=if(ll="ARLNL12","SaleTran",if(ll="ARLNL72","RefTran","other"))| stats count(ll) as numviewed by tran
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
<option name="charting.legend.placement">right</option>
</chart>
... View more