Splunk Search

Help to create drill-down on a stacked bar chart?

vrmandadi
Builder

Hello,

I am finding it difficult to create a drilldown on bar chart which has:

A
B
C

with success and failures stacked. I am trying to create a drilldown when clicking on the failures of each of them (see attachment), but I am not finding any luck in that.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this for your drilldown eval

 <eval token="success">if('click.name'="AUTHENTIC" AND 'click.value2'="Failure", "success", null())</eval>
 <eval token="failure">if('click.name'="BANK" AND 'click.value2'="Failure", "failure", null())</eval>
 <eval token="other">if('click.name'="RTDC" AND 'click.value2'="Failure", "other", null())</eval>
0 Karma

ashishlal82
Explorer

I have similar issue. I have a chart with Y-axis Names of Host Names and Y-Axis as count with Auth and Unauth as stacked bar. If some clicks on either Auth or unauth. the click even should capture the host names and auth or unauth and pass this value to the desitination form to produce a table.

Not sure how to pass values from source to destination? Any help

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @ashishlal82,
You might want to check out this topic in our documentation. It offers advice and some examples for creating dynamic drilldown behavior and using tokens to pass values between source and destination:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Dynamicdrilldownindashboardsandforms

This topic on tokens might also be helpful to you:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/tokens

You can also see the Dashboard Examples app for some further ideas:

https://splunkbase.splunk.com/app/1603/

Hope this helps!

0 Karma

vrmandadi
Builder

Hi Somesh,

I tried your answer,but no luck with that,When clicked on any failure it is not showing any drill down instead redirecting to a search

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...