Dashboards & Visualizations

How to do drilldown depending on which bar in the bar chart was being clicked?

lctanlc
New Member

I am running on Splunk 6.4.3 and below is my source that presents a bar chart with the name of the Action on x-axis and the count on y-axis:

testing

<panel>
  <chart>
    <search>
      <query> ...|stats count by Action </query>
    </search>
    <option name="charting.drilldown">all</option>
    ...
  </chart>
</panel>

Is it possible to bring up another bar chart when I clicked on one of the bar?
E.g.,
Bar chart shows the following, x-axis vs y-axis:
Action X = 250 count
Action Y = 50 count
Action Z = 2500 count

If I click on Action X, I would like to show another bar chart that shows a breakdown of Action X by department. I.e., query is ... Action = Action X | |stats count by Department.

0 Karma
1 Solution

cmerriman
Super Champion

you can use $click.value$ to set the new token based on what is clicked to open a new panel.

http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/tokens#Combine_literal_values_with_token_value...

 <panel>
   <chart>
     <search>
       <query> ...|stats count by Action </query>
     </search>
     <drilldown>
         <set token="newpanel>$click.value|s$</set>
    </drilldown>
     <option name="charting.drilldown">all</option>
     ...
   </chart>
 </panel>
  .....
<query>...Action=$click.value|s$....

View solution in original post

0 Karma

cmerriman
Super Champion

you can use $click.value$ to set the new token based on what is clicked to open a new panel.

http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/tokens#Combine_literal_values_with_token_value...

 <panel>
   <chart>
     <search>
       <query> ...|stats count by Action </query>
     </search>
     <drilldown>
         <set token="newpanel>$click.value|s$</set>
    </drilldown>
     <option name="charting.drilldown">all</option>
     ...
   </chart>
 </panel>
  .....
<query>...Action=$click.value|s$....
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...