Dashboards & Visualizations

Drilldown pie chart to non visible column

bowesmana
SplunkTrust
SplunkTrust

I have a pie chart with Name/Count, but for each name there is a key which then refers to a row in a KV store for that name.

So, I have a table with

Name, Count, key

The pie chart displays as expected, but when I click on the chart segment for a given name, I an trying to capture the token

<set token="key">$row.key$</set>

However, that always returns $row.key$, so won't give me the actual column content. Using $row.Name$ or $row.Count$ gives me the data in the table.

I can't find if this is supported or not.

0 Karma

jhanvidattani
Path Finder

@bowesmana 

Yes, the row is not working with a pie-chart. Can you check the below code to implement your use case?

<dashboard>
  <label>States</label>
  <row>
    <panel>
      <chart>
        <title>States Chart</title>
        <search>
          <query>| inputlookup geo_attr_us_states | stats count by state_name</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="my_token">$click.value$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table depends="$my_token$">
        <title>States Details</title>
        <search>
          <query>| inputlookup geo_attr_us_states where state_name="$my_token$" </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="count">5</option>
      </table>
    </panel>
  </row>
</dashboard>

 

If you find my solution useful, an upvote would be appreciated.

0 Karma

tiagofbmm
Influencer

In a pie chart you don't have a row. So for either key or value extraction to a token you'd need:

      <set token="key">$click.value$</set>
      <set token="value">$click.value2$</set>
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Technically you do have rows, just that the column dimension is only drawn from column 1 (entity) and column 2 (count). You can in practice have as many columns in the table the pie chart is drawn from and the click values $row.col1$ and $row.col2$ work, but sadly $row.col3$ does not.

That's a pain, as in event tables, you can include hidden fields by using the fields element, but this doesn't work in charts .

Just wondered if there was a way to solve this, as it makes the drilldown search have to repeat with a where clause, but even then it's not safe, as the where works on click.value, not the key needed and that's not unique.

BernardEAI
Communicator

We have the same problem. We store a list of items in a row in the search that is used to create a pie chart. The end of the search looks as follows:

| streamstats count as Count, values(ITEM_ID) as ITEM_list by DEPT
| dedup DEPT sortby -Count
| table DEPT, Count, ITEM_list 

The pie chart draws correctly, using DEPT as fields and Count as counts for the chart. In the drilldown, we set:

<set token="ITEM_list">$row.ITEM_list$</set>

The idea is to use the ITEM_list token in a subsequent search. This technique works perfectly with bar charts, but the drilldown for the pie chart does not set the token as required. I think this is a functionality that does not work in the pie chart.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Yes, pie chart does not support $row.X$ drilldown tokens 😞

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...