Hi,
Something eiher I forgot or not getting right. I have a chart. See attached. When I click on the EVENTYPE value in chart, my additional stats table picks up search based off of the value clicked in chart and it is working fine.
Issue is:
- I need default results to be ALL values.
- When user clicks on EVENTTYPE in chart, user should get the selected results based off of value clicked in chart. I do not want to use drop down etc. it needs to be chart clicks.
- Also need to know how to switch back to all after above selection?
My simple selection search is:
| search USERID="$userid$" AND EVENTTYPE="$eventtype$"
Above SPL keeps saying "search waiting for input" and like I said, need default to be all, when clicked, show selective results and then need to switch back to all again.
Thanks in- advance!!!!
@mbasharat I think what you are looking for is to have drilldown token pre-populated with * to display all the values and on drilldown from chart you want to set the same to specific value.
You can use <init> section in Simple XML Dashboard (version 6.5 and above) for this. Also you would still need some way to reset the filter to * for All values as the same will not be available in your chart. Please refer below to a run anywhere example that does this using <init> section and Link List input.
The screenshot below has first snippet is where All is drilldown value by default or on reset and second snippet is specific drilldown from Pie Chart to Timechart below (by clicking on Specific Pie Slice, in this example INFO).
Following is the complete Simple XML code for above example:
<form>
<label>Pie Chart Drilldown with Default Token</label>
<init>
<set token="component">*</set>
<set token="componentLabel">All</set>
<unset token="tokShowResetButton"></unset>
</init>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<title>Click Pie Chart to Drilldown with specific log_level</title>
<chart>
<search>
<query>index=_internal sourcetype=splunkd
| stats count by log_level</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<drilldown>
<set token="component">$click.value$</set>
<set token="componentLabel">$click.value$</set>
<set token="tokShowResetButton"></set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<title>Show Component drilldown details for $componentLabel$ log_level</title>
<chart>
<search>
<query>index=_internal sourcetype=splunkd log_level="$component$"
| timechart count by component</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row depends="$tokShowResetButton$">
<panel>
<input id="splk_chkbox_reset" type="link" token="tokReset" searchWhenChanged="true">
<label></label>
<choice value="reset">Reset to All</choice>
<change>
<condition value="reset">
<set token="component">*</set>
<set token="componentLabel">All</set>
<unset token="form.tokReset"></unset>
<unset token="tokShowResetButton"></unset>
</condition>
</change>
</input>
<html depends="$alwaysHideCSSPanel$">
<style>
#splk_chkbox_reset {
float: right;
}
</style>
</html>
</panel>
</row>
</form>
@mbasharat I think what you are looking for is to have drilldown token pre-populated with * to display all the values and on drilldown from chart you want to set the same to specific value.
You can use <init> section in Simple XML Dashboard (version 6.5 and above) for this. Also you would still need some way to reset the filter to * for All values as the same will not be available in your chart. Please refer below to a run anywhere example that does this using <init> section and Link List input.
The screenshot below has first snippet is where All is drilldown value by default or on reset and second snippet is specific drilldown from Pie Chart to Timechart below (by clicking on Specific Pie Slice, in this example INFO).
Following is the complete Simple XML code for above example:
<form>
<label>Pie Chart Drilldown with Default Token</label>
<init>
<set token="component">*</set>
<set token="componentLabel">All</set>
<unset token="tokShowResetButton"></unset>
</init>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<title>Click Pie Chart to Drilldown with specific log_level</title>
<chart>
<search>
<query>index=_internal sourcetype=splunkd
| stats count by log_level</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<drilldown>
<set token="component">$click.value$</set>
<set token="componentLabel">$click.value$</set>
<set token="tokShowResetButton"></set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<title>Show Component drilldown details for $componentLabel$ log_level</title>
<chart>
<search>
<query>index=_internal sourcetype=splunkd log_level="$component$"
| timechart count by component</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row depends="$tokShowResetButton$">
<panel>
<input id="splk_chkbox_reset" type="link" token="tokReset" searchWhenChanged="true">
<label></label>
<choice value="reset">Reset to All</choice>
<change>
<condition value="reset">
<set token="component">*</set>
<set token="componentLabel">All</set>
<unset token="form.tokReset"></unset>
<unset token="tokShowResetButton"></unset>
</condition>
</change>
</input>
<html depends="$alwaysHideCSSPanel$">
<style>
#splk_chkbox_reset {
float: right;
}
</style>
</html>
</panel>
</row>
</form>
