Dashboards & Visualizations

how could I generate a wildcard for a contextual drilldown token in a pie chart?

cphair
Builder

I have a conditional drilldown from a simple XML pie chart that opens a chart in a new panel based on which pie slice I clicked. I've been asked to also make it possible to drill down on all values--basically setting the token to a star. Is there a way to do that from the chart itself? Or do I need to do something hacky like add an input dropdown to my panel that will toggle between a star drilldown and a per-slice drilldown?

0 Karma

niketn
Legend

You can definitely set token within selection event of the Pie chart. However, since the value is always going to be , I am not sure as to why you can not have a panel with hard-coded [fieldname]= and only set the $earliest$ and $latest$ tokens from the pie chart, which I believe you are already doing right now.

<selection>
  <set token="allValues">*</set>
</selection>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cphair
Builder

I still want the user to be able to drill down on the value in a clicked section of the pie chart. The problem is that there is no way to click on all sections at once.

0 Karma

niketn
Legend

I think above should still solve your problem. The token allValues will be set when you click on Pie Chart.

In your search you can use [YourFieldName]=$allValues$

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

Can you give what field is the pie chart built on and what is the search you want to run when the Pie chart is clicked?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...