Splunk Search

Can I Disable Chart Legend Drilldown - Keep Chart Cell Drilldown?

Ant1D
Motivator

Hi,

I have asked a similar question already but have not had an answer so I thought I would try again because I believe an answer to this issue could be useful to many users.

The title says it all. We can drilldown on data from charts by clicking on a chart cell or by clicking on a chart legend. I want to keep the former (chart cell drilldown) whilst not being able to do the latter (chart legend drilldown). Is this possible?

An answer to this would be a big winner.

Labels (1)

paramagurukarth
Builder

Add the below row to your dashboards to disable drill-downs on legends

<row id="hidden_row">
    <panel>
        <html>
            <style>
                .highcharts-legend-item:active {
                    pointer-events: none !important;
                }
                #hidden_row{
                     display:none !important;
                }
             </style>
         </html>
    </panel>
</row>

Above one is a per dashboard solution. If you want to disable legend-drilldown in all your dashboards..
add a dashboard.css to your apps /appserver/static/ path and add just the below css definition to that file..

.highcharts-legend-item:active {
    pointer-events: none !important;
}

If you want to apply this for a specify pane, set ID for that panel and use that ID i your CSS selector like below..

<panel id="my_panel_id">
     <!-- Your chart definition here -->
....
#my_panel_id .highcharts-legend-item:active {
        pointer-events: none !important;
    }
0 Karma

rrossetti
Splunk Employee
Splunk Employee

This css selector did not work for me using simple xml dashboard currently, but what did work is using this:

/* Disable legend mouse cursor on hover*/
.highcharts-a11y-proxy-button:hover {
cursor: default !important;
}
/* disable clicks*/
.highcharts-a11y-proxy-button:active {
pointer-events: none !important;
}
0 Karma

mrccasi
Explorer

Hi - how about if only a particular chart in a dashboard i want to disable the legend? thank you.

0 Karma

rjthibod
Champion

My answer above works for particular charts.

paramagurukarth
Builder

Add ID attribute to your chart/panel and then you can select like

#given_panel_id .highcharts-legend-item:active {
     pointer-events: none !important;
 }
0 Karma

mrccasi
Explorer

hi rjthibod - thanks but it does not work for me since i have a scatter chart which is kinda have a messy click.values.

thanks for sharing paramagurukarthikeyan! hope it works.

0 Karma

mrccasi
Explorer

it works thanks for your help paramagurukarthikeyan 🙂

0 Karma

rjthibod
Champion

Resurrecting an old question but an important one for app developers.

The answer is it depends.

In 6.0 to 6.2, you can only really do this with custom JS extensions to SimpleXML. There is no built-in way to do it using only SimpleXML. Assume you have a chart with the id top_users. In JS, you use two event listeners to bypass the legend drilldown by only paying attention to the chart drilldown event. The code pattern looks like this:

...
var chart_top_users = mvc.Components.getInstance("top_users");
chart_top_users.on("click", function(e) {
   e.preventDefault();
});
chart_top_users.on("click:chart", function(e) {
  // ... Do your chart drilldown actions ...
});

In Splunk 6.3 and newer, you can use the new functionality in SimpleXML and the condition elements to spy on the presence of the row._span field for time-based charts. For non time-based charts, I don't think there is a solution, but it is a little hard to see where there is much of a difference between the legend and the rows. Anyway, returning to the code, the corresponding SimpleXML to spy on the row._span field would look like this.

<chart id="top_users">
  <search><query> ... .</query></search>
  <option name="charting.drilldown">all</option>
  <drilldown target="_blank">
    <condition match="isnotnull('row._span')">
      <!-- Insert your chart drilldown logic ... -->
    </condition>
    <condition></condition> 
  </drilldown>
</chart>

If all else fails in SimpleXML, you can always use the SplunkJS approach. It is supported in all versions of Splunk 6.X.

Ant1D
Motivator

I am not sure if the SimpleXML method would work.

According to the documentation here when it comes to drilldowns, the only attribute available for the tag is field. The match attribute is only available for inputs

0 Karma

rjthibod
Champion

I promise you this works. It is in my apps running on 6.4 - 6.6.

0 Karma

mrccasi
Explorer

hi - how did you make it work? i am struggling on legend as well. thanks!

0 Karma

rjthibod
Champion

I make it work using the methods I posted in the answer.

If you are doing a Splunk search like timechart or chart that produces a hidden row called _span, then you can use the SimpleXML method I posted in the second part of my answer. You can also download my app (Layer8Insight App for Splunk, https://splunkbase.splunk.com/app/3171/) and see the many places in XML where I use this method, such as the example below. The first condition triggers when the user clicks a series in the chart (not legend) and not labelled "OTHER'. The second condition is triggered if the user clicks "OTHER" in the chart (not legend), and the final empty <condition> that does nothing will be hit if the user clicks on the legend.

This app works on 6.4 and newer, so it does work for current versions of Splunk.

        <drilldown>
          <condition match="isnotnull('row._span') AND 'click.name2' != &quot;OTHER&quot;">
            <eval token="form.dd_time.earliest">$earliest$ - 2*$row._span$</eval>
            <set token="form.dd_time.latest">$latest$</set>
            <set token="form.dd_filter_target_value">$click.name2$</set>
            <set token="set_dd_enabled">true</set>
          </condition>
          <condition match="isnotnull('row._span')">
            <eval token="form.dd_time.earliest">$earliest$ - 2*$row._span$</eval>
            <set token="form.dd_time.latest">$latest$</set>
            <set token="form.dd_filter_target_value">*</set>
            <set token="set_dd_enabled">true</set>
          </condition>
          <condition></condition>
        </drilldown>
0 Karma

jleduc
Explorer

According to my knowledge of Highcharts, which is Splunk JS chart underlying graph library, clicking on the legend or the chart is controlled by the same property.

So Highcharts cannot dissociate the 2 elements and therefore JS chart cannot defines different actions for legend and chart.

I have no idea about FLashchart.

In JS chart you could still have a graph with no legend with drilldown enabled and a masterlegend with no graph in another panel, with drilldown disabled, this should work, but I do not know it it fits in your needs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...