Dashboards & Visualizations

Drill down from pie chart

appleman
Contributor

Hello,

How can I drill down from pie chart to my search?
I added the drill down link on my dashboard XML, but it didn't work.

Thank you in advance.


パイチャートの値をクリックして、ドリルダウンで自分で作成したサーチにリンクさせる方法を教えて下さい。





iOS
index=A sourcetype=app_log id=abc type=I
| stats count by name
| sort - count | head 20

0
now
visible
visible
linear
linear
pie
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right


<![CDATA[ /app/search/search?q=search%20index%3DA%20sourcetype%3Dapp_log%20source!%3D4XXX.csv%20id%3Dabc%20$row.name$%20%7C%20stats%20count%20by%20id%20%7%20sort%20-%20count%20%7%20head%2020%20&earliest=0&latest=]]>


0 Karma
1 Solution

melonman
Motivator

Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.

== pie1.xml

<form>
  <label>pie1</label>
  <description/>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default/>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>pie</title>
      <searchString>index=_* | top sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">right</option>

<drilldown>
  <link>
  <![CDATA[
/app/search/pie2?form.st=$click.value$
  ]]>
  </link>
</drilldown>
    </chart>
  </row>
</form>

alt text

== pie2.xml

<form>
  <label>pie2</label>
  <description/>
  <fieldset autoRun="true">
    <input type="text" token="st">
      <default>*</default>
    </input>  
  </fieldset>
  <row>
    <chart>
      <title>chart1</title>
      <searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
    </chart>
  </row>
  <row>
    <event>
      <title>raw</title>
      <searchString>index=_* sourcetype=$st$ | head 10</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="list.drilldown">full</option>
      <option name="list.wrap">1</option>
      <option name="maxLines">5</option>
      <option name="raw.drilldown">full</option>
      <option name="rowNumbers">0</option>
      <option name="table.drilldown">1</option>
      <option name="table.wrap">1</option>
      <option name="type">list</option>
      <fields>["host","source","sourcetype"]</fields>
    </event>
  </row>
</form>

alt text

View solution in original post

melonman
Motivator

Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.

== pie1.xml

<form>
  <label>pie1</label>
  <description/>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default/>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>pie</title>
      <searchString>index=_* | top sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">right</option>

<drilldown>
  <link>
  <![CDATA[
/app/search/pie2?form.st=$click.value$
  ]]>
  </link>
</drilldown>
    </chart>
  </row>
</form>

alt text

== pie2.xml

<form>
  <label>pie2</label>
  <description/>
  <fieldset autoRun="true">
    <input type="text" token="st">
      <default>*</default>
    </input>  
  </fieldset>
  <row>
    <chart>
      <title>chart1</title>
      <searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
    </chart>
  </row>
  <row>
    <event>
      <title>raw</title>
      <searchString>index=_* sourcetype=$st$ | head 10</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="list.drilldown">full</option>
      <option name="list.wrap">1</option>
      <option name="maxLines">5</option>
      <option name="raw.drilldown">full</option>
      <option name="rowNumbers">0</option>
      <option name="table.drilldown">1</option>
      <option name="table.wrap">1</option>
      <option name="type">list</option>
      <fields>["host","source","sourcetype"]</fields>
    </event>
  </row>
</form>

alt text

Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...