Dashboards & Visualizations

Drill down from pie chart

appleman
Contributor

Hello,

How can I drill down from pie chart to my search?
I added the drill down link on my dashboard XML, but it didn't work.

Thank you in advance.


パイチャートの値をクリックして、ドリルダウンで自分で作成したサーチにリンクさせる方法を教えて下さい。





iOS
index=A sourcetype=app_log id=abc type=I
| stats count by name
| sort - count | head 20

0
now
visible
visible
linear
linear
pie
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right


<![CDATA[ /app/search/search?q=search%20index%3DA%20sourcetype%3Dapp_log%20source!%3D4XXX.csv%20id%3Dabc%20$row.name$%20%7C%20stats%20count%20by%20id%20%7%20sort%20-%20count%20%7%20head%2020%20&earliest=0&latest=]]>


0 Karma
1 Solution

melonman
Motivator

Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.

== pie1.xml

<form>
  <label>pie1</label>
  <description/>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default/>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>pie</title>
      <searchString>index=_* | top sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">right</option>

<drilldown>
  <link>
  <![CDATA[
/app/search/pie2?form.st=$click.value$
  ]]>
  </link>
</drilldown>
    </chart>
  </row>
</form>

alt text

== pie2.xml

<form>
  <label>pie2</label>
  <description/>
  <fieldset autoRun="true">
    <input type="text" token="st">
      <default>*</default>
    </input>  
  </fieldset>
  <row>
    <chart>
      <title>chart1</title>
      <searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
    </chart>
  </row>
  <row>
    <event>
      <title>raw</title>
      <searchString>index=_* sourcetype=$st$ | head 10</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="list.drilldown">full</option>
      <option name="list.wrap">1</option>
      <option name="maxLines">5</option>
      <option name="raw.drilldown">full</option>
      <option name="rowNumbers">0</option>
      <option name="table.drilldown">1</option>
      <option name="table.wrap">1</option>
      <option name="type">list</option>
      <fields>["host","source","sourcetype"]</fields>
    </event>
  </row>
</form>

alt text

View solution in original post

melonman
Motivator

Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.

== pie1.xml

<form>
  <label>pie1</label>
  <description/>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default/>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>pie</title>
      <searchString>index=_* | top sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">right</option>

<drilldown>
  <link>
  <![CDATA[
/app/search/pie2?form.st=$click.value$
  ]]>
  </link>
</drilldown>
    </chart>
  </row>
</form>

alt text

== pie2.xml

<form>
  <label>pie2</label>
  <description/>
  <fieldset autoRun="true">
    <input type="text" token="st">
      <default>*</default>
    </input>  
  </fieldset>
  <row>
    <chart>
      <title>chart1</title>
      <searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
    </chart>
  </row>
  <row>
    <event>
      <title>raw</title>
      <searchString>index=_* sourcetype=$st$ | head 10</searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="list.drilldown">full</option>
      <option name="list.wrap">1</option>
      <option name="maxLines">5</option>
      <option name="raw.drilldown">full</option>
      <option name="rowNumbers">0</option>
      <option name="table.drilldown">1</option>
      <option name="table.wrap">1</option>
      <option name="type">list</option>
      <fields>["host","source","sourcetype"]</fields>
    </event>
  </row>
</form>

alt text

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...