Dashboards & Visualizations

How to do drilldown depending on which bar in the bar chart was being clicked?

lctanlc
New Member

I am running on Splunk 6.4.3 and below is my source that presents a bar chart with the name of the Action on x-axis and the count on y-axis:

testing

<panel>
  <chart>
    <search>
      <query> ...|stats count by Action </query>
    </search>
    <option name="charting.drilldown">all</option>
    ...
  </chart>
</panel>

Is it possible to bring up another bar chart when I clicked on one of the bar?
E.g.,
Bar chart shows the following, x-axis vs y-axis:
Action X = 250 count
Action Y = 50 count
Action Z = 2500 count

If I click on Action X, I would like to show another bar chart that shows a breakdown of Action X by department. I.e., query is ... Action = Action X | |stats count by Department.

0 Karma
1 Solution

cmerriman
Super Champion

you can use $click.value$ to set the new token based on what is clicked to open a new panel.

http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/tokens#Combine_literal_values_with_token_value...

 <panel>
   <chart>
     <search>
       <query> ...|stats count by Action </query>
     </search>
     <drilldown>
         <set token="newpanel>$click.value|s$</set>
    </drilldown>
     <option name="charting.drilldown">all</option>
     ...
   </chart>
 </panel>
  .....
<query>...Action=$click.value|s$....

View solution in original post

0 Karma

cmerriman
Super Champion

you can use $click.value$ to set the new token based on what is clicked to open a new panel.

http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/tokens#Combine_literal_values_with_token_value...

 <panel>
   <chart>
     <search>
       <query> ...|stats count by Action </query>
     </search>
     <drilldown>
         <set token="newpanel>$click.value|s$</set>
    </drilldown>
     <option name="charting.drilldown">all</option>
     ...
   </chart>
 </panel>
  .....
<query>...Action=$click.value|s$....
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...