Dashboards & Visualizations

Drill down from pie chart

appleman
Contributor

Hello,

How can I drill down from pie chart to my search?
I added the drill down link on my dashboard XML, but it didn't work.

Thank you in advance.


パイチャートの値をクリックして、ドリルダウンで自分で作成したサーチにリンクさせる方法を教えて下さい。





iOS
index=A sourcetype=app_log id=abc type=I
| stats count by name
| sort - count | head 20

0
now
visible
visible
linear
linear
pie
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right


<![CDATA[ /app/search/search?q=search%20index%3DA%20sourcetype%3Dapp_log%20source!%3D4XXX.csv%20id%3Dabc%20$row.name$%20%7C%20stats%20count%20by%20id%20%7%20sort%20-%20count%20%7%20head%2020%20&earliest=0&latest=]]>


0 Karma
1 Solution

melonman
Motivator

Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.

== pie1.xml

<form>
  <label>pie1</label>
  <description/>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default/>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>pie</title>
      <searchString>index=_* | top sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">right</option>

<drilldown>
  <link>
  <![CDATA[
/app/search/pie2?form.st=$click.value$
  ]]>
  </link>
</drilldown>
    </chart>
  </row>
</form>

alt text

== pie2.xml

<form>
  <label>pie2</label>
  <description/>
  <fieldset autoRun="true">
    <input type="text" token="st">
      <default>*</default>
    </input>  
  </fieldset>
  <row>
    <chart>
      <title>chart1</title>
      <searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
    </chart>
  </row>
  <row>
    <event>
      <title>raw</title>
      <searchString>index=_* sourcetype=$st$ | head 10</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="list.drilldown">full</option>
      <option name="list.wrap">1</option>
      <option name="maxLines">5</option>
      <option name="raw.drilldown">full</option>
      <option name="rowNumbers">0</option>
      <option name="table.drilldown">1</option>
      <option name="table.wrap">1</option>
      <option name="type">list</option>
      <fields>["host","source","sourcetype"]</fields>
    </event>
  </row>
</form>

alt text

View solution in original post

melonman
Motivator

Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.

== pie1.xml

<form>
  <label>pie1</label>
  <description/>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default/>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>pie</title>
      <searchString>index=_* | top sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">right</option>

<drilldown>
  <link>
  <![CDATA[
/app/search/pie2?form.st=$click.value$
  ]]>
  </link>
</drilldown>
    </chart>
  </row>
</form>

alt text

== pie2.xml

<form>
  <label>pie2</label>
  <description/>
  <fieldset autoRun="true">
    <input type="text" token="st">
      <default>*</default>
    </input>  
  </fieldset>
  <row>
    <chart>
      <title>chart1</title>
      <searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
    </chart>
  </row>
  <row>
    <event>
      <title>raw</title>
      <searchString>index=_* sourcetype=$st$ | head 10</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="list.drilldown">full</option>
      <option name="list.wrap">1</option>
      <option name="maxLines">5</option>
      <option name="raw.drilldown">full</option>
      <option name="rowNumbers">0</option>
      <option name="table.drilldown">1</option>
      <option name="table.wrap">1</option>
      <option name="type">list</option>
      <fields>["host","source","sourcetype"]</fields>
    </event>
  </row>
</form>

alt text

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...