Dashboards & Visualizations

How to create multiple drilldown in a pie chart?

macadminrohit
Contributor

Hi,

I have a search query through which i am creating a pie chart. one piece of the pie chart will show the successful events, other piece will show the Error events from the search. My requirement is to drill down to the respective events by clicking on the pieces of the pie chart.

index=_internal sourcetype=abc host=server1 source!="*SEND_EMAILS*" NOT "NO ERRORS" | dedup source  | eval fail=if(searchmatch("error OR fail*"),1,0)  | stats count as Total sum(fail) as "Error/failed" | transpose

This creates a pie chart with error and total events. So if i click on Error piece it should take me to the events which resulted in error and if i click on rest of the pie chart it should take me to the total events.

0 Karma
1 Solution

sundareshr
Legend

Try like this

<dashboard>
  <label></label>
  <row>
    <panel>
      <chart>
        <title>f:$f$</title>
        <search>
          <query>index=_internal sourcetype=abc host=server1 source!="*SEND_EMAILS*" NOT "NO ERRORS" 
| dedup source 
| eval fail=if(searchmatch("error OR fail*"),1,0) 
| stats count as Total sum(fail) as "Error/failed" 
| eval Total=100 
| eval "Error/failed"=25
| transpose</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <eval token="f">if(match($click.value$, "Error"), "error OR fail\*", "\*"</eval>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal sourcetype=abc host=server1 source!="*SEND_EMAILS*" NOT "NO ERRORS" 
| dedup source
| eval fail=if(searchmatch("$f$"),1,0) 
| where fail=1</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

sundareshr
Legend

Try like this

<dashboard>
  <label></label>
  <row>
    <panel>
      <chart>
        <title>f:$f$</title>
        <search>
          <query>index=_internal sourcetype=abc host=server1 source!="*SEND_EMAILS*" NOT "NO ERRORS" 
| dedup source 
| eval fail=if(searchmatch("error OR fail*"),1,0) 
| stats count as Total sum(fail) as "Error/failed" 
| eval Total=100 
| eval "Error/failed"=25
| transpose</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <drilldown>
          <eval token="f">if(match($click.value$, "Error"), "error OR fail\*", "\*"</eval>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal sourcetype=abc host=server1 source!="*SEND_EMAILS*" NOT "NO ERRORS" 
| dedup source
| eval fail=if(searchmatch("$f$"),1,0) 
| where fail=1</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...