I have a field "Allow/Deny"(fildName) which has values Allow/ Deny for a particular Host. How can I produce a stacked chart with number of Allow & Deny for a particular HostName?
This below query just gives me a count
stats count(Authorized/Unauthorized) by HostNames
Try like this (check the exact field name in by clause)
your base search |chart count over HostNames by "Authorized/Unauthorized"
This should give your fields HostNames, Allow, Deny. Once you get that go to visualization, select column chart and stacked option
Try like this (check the exact field name in by clause)
your base search |chart count over HostNames by "Authorized/Unauthorized"
This should give your fields HostNames, Allow, Deny. Once you get that go to visualization, select column chart and stacked option
This is what my source dashboard looks like
list_of_software_by_hostnames?form.host_value
list_of_software_by_hostnames?form.cat_name
Question: is host_value and cat_name fields available to the destination dashboard in the same app?
2) Do I create a new fields in the destination dashboard and pass the value / or I can directly use them in a query?
The examples in the link help you to create a Form from drill down table. I am trying to drill down from stacked bar chart to a table(destination) within the same panel
Authorized_List
This Dashboard presents List of Assets with number of Authorized and Unauthorized files
<panel>
<title>Number of Authorized And Unauthorized Files by Assets</title>
<chart>
<title>Authorized_Files</title>
<search ref="Authorized_Files"></search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<set token="type_tok">$click.value2$</set>
<set token="cat_tok">$click.name$</set>
<drilldown target =" List of Softwares"
<link>List of Softwares </link>
</drilldown>
</chart>
</panel>
Eventually what I am trying to do is if anyone clicks Auth/unauth bar for a particular asset which is my Y- axis, it should display a table list of software installed on that hostname.
Question: 1) Should I create a destination dashboard and then link it? or does Splunk creates it dynamically?
You would have to create the drilldown dashboard and provide link to that dashboard and pass required tokens.
Thanks, I was able to create the stacked Bar chart. how do I Create drill-down on a stacked bar chart so that for a particular Hostname, wheather clicked Auth / Unauth would display another table with list of software by HostName that are either Auth/Unauth. I have reading this http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms for reference> Not sure where to start
See the list of tokens that you can use in the drilldown here
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...
You would need these
click.value Value of the field or category for the x-axis. Not available when the legend has been clicked.
click.name2 Name of the field or series for the y-axis.
See this for solution for same page drilldown
https://answers.splunk.com/answers/113562/same-page-drilldown-splunk-6-simple-xml.html