Dashboards & Visualizations

Splunk pie chart drilldown

vik123ash
Explorer

Hi All,

Please help me here.

I have created a dashboard with 1 pie chart . The pie chart has 4-5 sectors. Is it possible to click on each sector and after clicking on each sector a new webpage will open that includes details for each individual sector?

Could you please advise?

Vikash

1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI
Can you try drilldown from below dashaboard code??

<dashboard>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal  | stats  count by component</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal component=$click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>
        </drilldown>
      </chart>
    </panel>
  </row>
</dashboard>

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI
Can you try drilldown from below dashaboard code??

<dashboard>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal  | stats  count by component</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal component=$click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>
        </drilldown>
      </chart>
    </panel>
  </row>
</dashboard>

Thanks

View solution in original post

vik123ash
Explorer

Thanks Kamalesh.

i can see that after clicking on each sector it is searching in search for that specific sector.

is it possible that if i click on any sector it opens hardcoded link i have created for each sector.

Suppose my sector name is A, it will open link for A and if i click on Sector B, it opens link for B. if there are 10 sectors , i want to hardcode separate link for each sector.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

Few changes in drilldown.

<drilldown>
          <condition match="match('click.value',&quot;A&quot;)">
            <link target="_blank">search?q=index=_internal $click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>  
          </condition>
          <condition match="match('click.value',&quot;B&quot;)">
            <link target="_blank">search?q=index=_internal $click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>  
          </condition>
          <condition match="match('click.value',&quot;C&quot;)">
            <link target="_blank">search?q=index=_internal $click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>  
          </condition>
          <condition>
            <link target="_blank">search?q=index=_internal component=$click.value$&amp;earliest=$earliest$&amp;latest=$latest$</link>  
          </condition>

        </drilldown>

Just change drilldown logic as per your requirement.

thanks

vik123ash
Explorer

Thanks a lot. it was superb.

1 more help please.

I am drilling down like this and its working. Time Range i selected for the first chart, i want to carry forward the same time Range in the Drilled down page also. Could you please advise.

For example i have selected 7 days time Range in Parent graph, and once i click on any of the sector it should also show same Time Range in second graph.

       <condition match="match('click.value',&quot;A&quot;)">
         <link target="_blank">https://abcde.com</link>  
                    </condition>
0 Karma

niketnilay
Legend

@vik123ash, I think @kamlesh_vaghela has already answered that in his previous comment.

If the Time Picker input in destination dashboard is tokTimeDest and that in the source is tokTimeSrc (You can have both Time Picker input tokens same for ease, I have just named them separate to draw out the distinction in the code)

<link target="_blank">search?q=index=_internal $click.value$&amp;form.tokTimeDes.earliest=$tokTimeSrc.earliest$&amp;form.tokTimeDes.=$tokTimeSrc.latest$</link>

And similarly for other condition blocks. Please try out and confirm.

Also ideally you should be creating a separate question once your original question has been answered to your satisfaction. I would request you to up vote Answer and all the comments from Kamlesh which have assisted you so far.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vik123ash
Explorer

Thanks a lot @kamlesh_vaghela & @Niketnilay.

it worked.

i am new to this page. was not aware much things. I will follow all guidelines from next times.

Thanks a lot to you guys.

0 Karma

niketnilay
Legend

@vik123ash, dont worry this is not a guideline, more of a recommendation 🙂 Splunk Community Members tend to pick up on Unanswered questions, so if you keep raising followup questions in the same thread it would be mostly up to only the one who responded to you (or those who are already following the question).

If you want to know the guidelines, here they are: https://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/Splunkcommunityguidelines

I feel all your questions have been answered in the thread so please go ahead and accept the same as answered. Also do up vote (hover over answer/comment and click the up arrow to up vote) all the comments that have helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vik123ash
Explorer

Thank you.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI guys,
can we mark this question closed?
Thanks.

0 Karma

vik123ash
Explorer

yes please.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!