I am running on Splunk 6.4.3 and below is my source that presents a bar chart with the name of the Action on x-axis and the count on y-axis:
testing
<panel>
<chart>
<search>
<query> ...|stats count by Action </query>
</search>
<option name="charting.drilldown">all</option>
...
</chart>
</panel>
Is it possible to bring up another bar chart when I clicked on one of the bar?
E.g.,
Bar chart shows the following, x-axis vs y-axis:
Action X = 250 count
Action Y = 50 count
Action Z = 2500 count
If I click on Action X, I would like to show another bar chart that shows a breakdown of Action X by department. I.e., query is ... Action = Action X | |stats count by Department.
you can use $click.value$ to set the new token based on what is clicked to open a new panel.
<panel>
<chart>
<search>
<query> ...|stats count by Action </query>
</search>
<drilldown>
<set token="newpanel>$click.value|s$</set>
</drilldown>
<option name="charting.drilldown">all</option>
...
</chart>
</panel>
.....
<query>...Action=$click.value|s$....
you can use $click.value$ to set the new token based on what is clicked to open a new panel.
<panel>
<chart>
<search>
<query> ...|stats count by Action </query>
</search>
<drilldown>
<set token="newpanel>$click.value|s$</set>
</drilldown>
<option name="charting.drilldown">all</option>
...
</chart>
</panel>
.....
<query>...Action=$click.value|s$....