Dashboards & Visualizations

Why custom drilldown XML in pie chart doesn't populate target field?

ppurokit
Path Finder

Hi All,

I have a pie chart where instead of using the default drilldown, i have a customized drilldown which i have added as part of the XML.

<dashboard>    <label>Daily XXXXX Reports</label>   <row>
    <chart>
      <searchName>Daily XXXXXX graph</searchName>
      <title>Top XXXXX - Last 24 hrs</title>
      <option name="charting.chart">pie</option>
      <option name="count">50</option>
      <option name="displayRowNumbers">true</option>
           <drilldown>
        <link>
            /app/XXX-ASA/flashtimeline?q=`cisco_asa` earliest=-24h@h latest=now |search src_ip="$row.Source Address$"
        </link>
      </drilldown>
    </chart>  </dashboard>

So from the Pie Chart when i click on the drilldown , the Source Address field never gets populated.

The same drilldown works fine for me on a "Table" Visualization.

Let me know on what needs to be changed for the value to get substituted.

1 Solution

theouhuios
Motivator

Instead of $row.Source Address$ can you try with $click.value$

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

This works for me:

<dashboard>
 <row>
  <chart>
   <searchString>index=_internal | stats sum(bytes) as "Total Bytes" by sourcetype | rename sourcetype as "Source Address" | sort - "Total Bytes"</searchString>
   <earliestTime>-15m</earliestTime>
   <latestTime>now</latestTime>
   <option name="charting.chart">pie</option>
   <drilldown>
    <link>search?q=index=_internal sourcetype="$row.Source Address$"</link>
   </drilldown>
  </chart>
 </row>
</dashboard>

The drilldown looks like this:

index=_internal sourcetype="splunkd_access"
0 Karma

theouhuios
Motivator

Instead of $row.Source Address$ can you try with $click.value$

ppurokit
Path Finder

Thanks for the suggestion theouhuios.

Instead of $row.Source Address$ tried $click.value$

It worked out Well.

Thanks

0 Karma

ppurokit
Path Finder

Hi Martin,

My Actual Search query is

index=summary sourcetype=stash search_name="summary - Bandwidth Reports" | stats sum(mbytes) as "Total MBytes" by src_ip | rename src_ip as "Source Address" | sort -"Total MBytes" | head 15

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What columns do you have in the underlying table?

Also, do remove that |search part to have the src_ip filter be a part of the main search.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...