Hi,
I have a search query through which i am creating a pie chart. one piece of the pie chart will show the successful events, other piece will show the Error events from the search. My requirement is to drill down to the respective events by clicking on the pieces of the pie chart.
index=_internal sourcetype=abc host=server1 source!="*SEND_EMAILS*" NOT "NO ERRORS" | dedup source | eval fail=if(searchmatch("error OR fail*"),1,0) | stats count as Total sum(fail) as "Error/failed" | transpose
This creates a pie chart with error and total events. So if i click on Error piece it should take me to the events which resulted in error and if i click on rest of the pie chart it should take me to the total events.
↧