Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Drilldown issues in pie chart

$
0
0

I am trying to implement a drill down from a pie chart. The pie chart displays stats on how many transactions have 'success' and 'pended' status. Here is the main query which generates the pie chart.

<![CDATA[index=ccsp_*_was sourcetype=$ccsp_env$ CleanUpLoggingModule | chart count by Claimstatus | fields ClaimStatus, count ]]>

Upon click, my drilldown search returns no results. Looking at the 'search job inspector', it appears that 'count' predicate is added to the original query. Here is the generated query. Can anyone suggest what I am doing wrong and how to get rid of the count="1248" predicate from the drill down query. I even added the "fields ClaimStatus, count" in my original query to see if it helps, but didn't. Appreciate your help.

search index=app_*_was sourcetype=app_env CleanUpLoggingModule  | rex "\[DCN (?<DCN>.*)-SL:"  | search Transtatus="success" count="1248"

Here is the xml snippet for drilldown logic.

<module name="FlashChart">
    <module name="HiddenSearch" autoRun="True">
    <param name="search">
        <![CDATA[index=app_*_was sourcetype=app_env CleanUpLoggingModule | rex "\[DCN (?<DCN>.*)-SL:" | search Transtatus="$status$" |  table DCN]]>
    </param>
    <module name="ConvertToIntention">
    <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="status">
                <param name="value">$click.value$</param>
            </param>                                                                                                   
        </param>
    </param><!-- End intention -->
    <module name="ConvertToDrilldownSearch" layoutPanel="panel_row2_col2">
        <module name="ResultsHeader">
            <param name="entityLabel">Results</param>
            <param name="entityName">results</param>
            <module name="Paginator">
                <param name="entityName">results</param>
                <module name="SimpleResultsTable">
                    <param name="count">10</param>
                    <param name="entityName">results</param>
                </module>
            </module>
        </module>
    </module>
    </module>
    </module>
</module>

Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>