Hello,
How can I drill down from pie chart to my search?
I added the drill down link on my dashboard XML, but it didn't work.
Thank you in advance.
パイチャートの値をクリックして、ドリルダウンで自分で作成したサーチにリンクさせる方法を教えて下さい。
| stats count by name
| sort - count | head 20
visible
visible
linear
linear
pie
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
<![CDATA[ /app/search/search?q=search%20index%3DA%20sourcetype%3Dapp_log%20source!%3D4XXX.csv%20id%3Dabc%20$row.name$%20%7C%20stats%20count%20by%20id%20%7%20sort%20-%20count%20%7%20head%2020%20&earliest=0&latest=]]>
Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.
== pie1.xml
<form>
<label>pie1</label>
<description/>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true">
<default/>
</input>
</fieldset>
<row>
<chart>
<title>pie</title>
<searchString>index=_* | top sourcetype</searchString>
<earliestTime>0</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<link>
<![CDATA[
/app/search/pie2?form.st=$click.value$
]]>
</link>
</drilldown>
</chart>
</row>
</form>
== pie2.xml
<form>
<label>pie2</label>
<description/>
<fieldset autoRun="true">
<input type="text" token="st">
<default>*</default>
</input>
</fieldset>
<row>
<chart>
<title>chart1</title>
<searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
<earliestTime>0</earliestTime>
<latestTime>now</latestTime>
</chart>
</row>
<row>
<event>
<title>raw</title>
<searchString>index=_* sourcetype=$st$ | head 10</searchString>
<earliestTime>0</earliestTime>
<latestTime>now</latestTime>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">1</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
<fields>["host","source","sourcetype"]</fields>
</event>
</row>
</form>
Maybe the following sample works for your case:
There is a pie chart in P1, and if you click pie chart, the value is passed to P2.
== pie1.xml
<form>
<label>pie1</label>
<description/>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true">
<default/>
</input>
</fieldset>
<row>
<chart>
<title>pie</title>
<searchString>index=_* | top sourcetype</searchString>
<earliestTime>0</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<link>
<![CDATA[
/app/search/pie2?form.st=$click.value$
]]>
</link>
</drilldown>
</chart>
</row>
</form>
== pie2.xml
<form>
<label>pie2</label>
<description/>
<fieldset autoRun="true">
<input type="text" token="st">
<default>*</default>
</input>
</fieldset>
<row>
<chart>
<title>chart1</title>
<searchString>index=_* sourcetype=$st$ | timechart count by sourcetype</searchString>
<earliestTime>0</earliestTime>
<latestTime>now</latestTime>
</chart>
</row>
<row>
<event>
<title>raw</title>
<searchString>index=_* sourcetype=$st$ | head 10</searchString>
<earliestTime>0</earliestTime>
<latestTime>now</latestTime>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">1</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
<fields>["host","source","sourcetype"]</fields>
</event>
</row>
</form>