Hi
I am displaying a pie chart from the data CLASS_Name + Method_Name, then a user clicks on the PIE chart i want to use only the CLASS_NAME to be set in the token (so the PIE chart will re-run). So i need to run an eval or something to split out the two and re-set the token. However i cant figure it out.
Below i can set the token TPS_Class_token to $row.fullyQualifiedMethod$ (CLASS_Name + Method_Name), but i need to get rid of the method name.
The REX is something like the following, but i am not sure where to applay it. rex field=$TPS_Class_token$ "(?P<CLASS>[^ ]*?)\s? ."
example of Class = limits.mlc.excesses.realtime.RealtimeExcessPublisher
example of method = read
=>fullyQualifiedMethod= limits.mlc.excesses.realtime.RealtimeExcessPublisher .read
<chart>
<title>TPS Time (Total Duration) Class = $TPS_Class_token$</title>
<search>
<query>index=mlc_live sourcetype=tps host=$host_token$ (user=* OR NOT user=*) NOT overflow=true | search name = $TPS_Class_token$ | eval fullyQualifiedMethod = name." .".operationIdentity | eval duration = endTime - startTime | stats sum(duration) as Total_Duration(ms) by $CLASS_OR_METHOD$</query>
<earliest>$tps_selection.earliest$</earliest>
<latest>$tps_selection.latest$</latest>
</search>
<drilldown>
<set token="TPS_Class_token">$row.fullyQualifiedMethod$</set>
</drilldown>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.placement">right</option>
<option name="wrap">true</option>
<option name="rowNumbers">0</option>
<option name="dataOverlayMode">none</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="table.drilldown">all</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
<fields>["host","source","sourcetype"]</fields>
</chart>
</panel>
I have never tried drill-down to the same panel. But it is an interesting concept. If you have the option, change the delim between CLASS & METHOD to something more unique (say #). You can then try <set token="TPS_Class_token">mvindex(split($row.fullyQualifiedMethod$, "#"). 0)</set>
@robertlynch2020, try this test dashboard. Should work as-is
<form>
<label>Test Dashboard</label>
<fieldset submitButton="false">
<input type="time" token="timepicker" searchWhenChanged="true">
<label>Timepicker</label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
<change>
<set token="val">*</set>
</change>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype="$val$" | eval st=sourcetype."#".source | eval x="$val$" | eval s=mvindex(split(st, "#"), 0) | stats count by s</query>
<earliest>$timepicker.earliest$</earliest>
<latest>$timepicker.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">false</option>
<option name="table.drilldown">all</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
<option name="wrap">true</option>
<option name="dataOverlayMode">none</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<eval token="val">mvindex(split($row.s$, "#"), 0)</eval>
</drilldown>
</chart>
</panel>
</row>
</form>
Cheers 🙂 This worked. Good man...
Awesome. Please mark answered to close it out. Thanks
Hi - Thanks for this, i think i am very close. I have done what you said and added in the #. However the token is been set to mvindex(split(limits.mlc.excesses.batch.DefaultBatchExcessEventConsumer #run, "#"). 0) and not value. limits.mlc.excesses.batch.DefaultBatchExcessEventConsumer
So i tried to add in eval, however that did not have any effect.
mvindex(split($row.fullyQualifiedMethod$, "#"). 0)
Then i tried , but this just opens a new search screen.
mvindex(split($row.fullyQualifiedMethod$, "#"). 0)
Use eval instead of set
mvindex(split("$row.fullyQualifiedMethod$", "#"). 0)
Hi - Thanks, but i have tried eval and no good, noting updates. I am not sure if it is because i am in drilldown of a pie chat that it wont evel. Any other ideas?
mvindex(split($row.fullyQualifiedMethod$, "#"). 0)