<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Condition value using a drilldown in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255920#M16035</link>
    <description>&lt;P&gt;See if this works&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;drilldown&amp;gt;
    &amp;lt;condition field="MSO - Click for Expanded View"&amp;gt;
        &amp;lt;set token="tablevariable"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
        &amp;lt;eval token="s_mso"&amp;gt;case("$click.value2$"="Cox Home Life - CHL", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"&amp;lt;/eval&amp;gt;
    &amp;lt;/condition&amp;gt;
    &amp;lt;condition field="*"&amp;gt;
        &amp;lt;unset token="tablevariable"&amp;gt;&amp;lt;/unset&amp;gt;
    &amp;lt;/condition&amp;gt;
&amp;lt;/change&amp;gt;
&amp;lt;/drilldown&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Wed, 31 Aug 2016 18:30:28 GMT</pubDate>
    <dc:creator>sundareshr</dc:creator>
    <dc:date>2016-08-31T18:30:28Z</dc:date>
    <item>
      <title>Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255914#M16029</link>
      <description>&lt;P&gt;Ok stumped (again......)&lt;/P&gt;

&lt;P&gt;I have this drilldown code &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;!-- Begin the conditional drill down --&amp;gt;
        &amp;lt;drilldown&amp;gt;
          &amp;lt;condition field="Trend"&amp;gt;
            &amp;lt;unset token="tablevalue"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition field="Current Cell Connectivity %"&amp;gt;
            &amp;lt;unset token="tablevalue"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition field="*"&amp;gt;
            &amp;lt;set token="tablevariable"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition value="Cox Home Life - CHL"&amp;gt;
            &amp;lt;set token="s_mso"&amp;gt;Cox&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition value="Cox Business Security Solutions - CBSS"&amp;gt;
            &amp;lt;set token="s_mso"&amp;gt;Coxsmb&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
        &amp;lt;/drilldown&amp;gt;
        &amp;lt;!-- End the conditional drill down --&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And the resulting chart &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;chart depends="$tablevariable$"&amp;gt;
        &amp;lt;title&amp;gt;Expanded Cell Connectivity for - $tablevariable$&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell"  |where mso=lower("$s_mso$") | eval stat_val=round(stat_val,2)| timechart  first(stat_val) as "Cell Connectivity"|&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;0&amp;lt;/earliest&amp;gt;
        &amp;lt;/search&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;What I'm hoping to do is this:&lt;/P&gt;

&lt;P&gt;If the value in the table is Cox Home Life - CHL, set the &lt;CODE&gt;$s_mso$&lt;/CODE&gt; token to "Cox" and then in the query search where s_mso="Cox"  (there is some upper to lowercase conversion there, but let's ignore that for now as I know it works)&lt;/P&gt;

&lt;P&gt;The problem is that the chart never appears, it simply says Search is waiting for data.   The only thing I can think of is that the token tablevariable isn't getting set but it should be due to the user click selection in the row.&lt;/P&gt;</description>
      <pubDate>Wed, 31 Aug 2016 17:47:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255914#M16029</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T17:47:05Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255915#M16030</link>
      <description>&lt;P&gt;Updated drilldown code (still no joy)&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;!-- Begin the conditional drill down --&amp;gt;
        &amp;lt;drilldown&amp;gt;
          &amp;lt;condition field="Trend"&amp;gt;
            &amp;lt;unset token="tablevariable"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition field="Current Cell Connectivity %"&amp;gt;
            &amp;lt;unset token="tablevariable"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition field="*"&amp;gt;
            &amp;lt;set token="tablevariable"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition tablevariable="Cox Home Life - CHL"&amp;gt;
            &amp;lt;set token="s_mso"&amp;gt;Cox&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition tablevariable="Cox Business Security Solutions - CBSS"&amp;gt;
            &amp;lt;set token="s_mso"&amp;gt;Coxsmb&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:06:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255915#M16030</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T18:06:13Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255916#M16031</link>
      <description>&lt;P&gt;First let me say that you do a fantastic job commenting your code. Even in dashboards &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;I think, the reason you don't see the chart is because the token &lt;CODE&gt;tablevariable&lt;/CODE&gt; doesn't get set unless the first two conditions fail. In other words, if condition &lt;CODE&gt;field=Trend&lt;/CODE&gt; OR &lt;CODE&gt;field="Current Cell Connectivity %"&lt;/CODE&gt; is met, the third, fourth fifth, etc will not be met. Try adding tablevariable to all conditions, like this&lt;/P&gt;

&lt;P&gt;*&lt;STRONG&gt;&lt;EM&gt;UPDATED&lt;/EM&gt;&lt;/STRONG&gt;*&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; &amp;lt;drilldown&amp;gt;
     &amp;lt;condition field="MSO - Click for Expanded View"&amp;gt;
         &amp;lt;set token="tablevariable"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
         &amp;lt;eval token="s_mso"&amp;gt;case("$click.value2$"="Cox Home Life - CHL", "Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"&amp;lt;/eval&amp;gt;
     &amp;lt;/condition&amp;gt;
     &amp;lt;condition field="*"&amp;gt;
         &amp;lt;unset token="tablevariable"&amp;gt;&amp;lt;/unset&amp;gt;
     &amp;lt;/condition&amp;gt;
 &amp;lt;/change&amp;gt;
 &amp;lt;/drilldown&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:07:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255916#M16031</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-08-31T18:07:31Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255917#M16032</link>
      <description>&lt;P&gt;Awwww making me blush &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;    If I didn't document I would be even more lost than I am today!!!  &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;On the updated code I realized that I had tablevalue instead of tablevariable so I fixed that.&lt;/P&gt;

&lt;P&gt;I only want tablevariable to be set if the user clicks on the first column so I guess I can rework that to make it simpler.   I'll do that and post the update (maybe it will work -- fingers crossed)&lt;/P&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:16:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255917#M16032</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T18:16:00Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255918#M16033</link>
      <description>&lt;P&gt;Updated code&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;!-- Begin the conditional drill down --&amp;gt;
        &amp;lt;drilldown&amp;gt;
          &amp;lt;condition field="MSO - Click for Expanded View"&amp;gt;
            &amp;lt;set token="tablevariable"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition field="*"&amp;gt;
            &amp;lt;unset token="tablevariable"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;/condition&amp;gt;

          &amp;lt;change&amp;gt;
          &amp;lt;condition tablevariable="Cox Home Life - CHL"&amp;gt;
            &amp;lt;set token="s_mso"&amp;gt;Cox&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition tablevariable="Cox Business Security Solutions - CBSS"&amp;gt;
            &amp;lt;set token="s_mso"&amp;gt;Coxsmb&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;/change&amp;gt;
        &amp;lt;/drilldown&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:20:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255918#M16033</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T18:20:11Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255919#M16034</link>
      <description>&lt;P&gt;A bit more info, if I remove &lt;CODE&gt;where mso="$s_mso$"&lt;/CODE&gt; from the expanded query it shows the chart.  The values are incorrect but the chart shows.   Something about the s_mso token isn't quite right but for the life of me I can't see it.&lt;/P&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:29:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255919#M16034</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T18:29:06Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255920#M16035</link>
      <description>&lt;P&gt;See if this works&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;drilldown&amp;gt;
    &amp;lt;condition field="MSO - Click for Expanded View"&amp;gt;
        &amp;lt;set token="tablevariable"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
        &amp;lt;eval token="s_mso"&amp;gt;case("$click.value2$"="Cox Home Life - CHL", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"&amp;lt;/eval&amp;gt;
    &amp;lt;/condition&amp;gt;
    &amp;lt;condition field="*"&amp;gt;
        &amp;lt;unset token="tablevariable"&amp;gt;&amp;lt;/unset&amp;gt;
    &amp;lt;/condition&amp;gt;
&amp;lt;/change&amp;gt;
&amp;lt;/drilldown&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:30:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255920#M16035</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-08-31T18:30:28Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255921#M16036</link>
      <description>&lt;P&gt;Hmmm I think you are close!&lt;/P&gt;

&lt;P&gt;Cox Home Life - CHL   should equal to "Cox"&lt;BR /&gt;
Cox Business Security Solutions - CBSS  should equal to "CBSS"&lt;/P&gt;

&lt;P&gt;I tried poking around with the case statement to make that work but alas....  I made it NOT work &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:37:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255921#M16036</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T18:37:29Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255922#M16037</link>
      <description>&lt;P&gt;This is the update I tried&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;         &amp;lt;eval token="s_mso"&amp;gt;case("$click.value2$"="Cox Home Life - CHL","Cox", "$click.value2$"="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"&amp;lt;/eval&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:39:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255922#M16037</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T18:39:17Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255923#M16038</link>
      <description>&lt;P&gt;It seems like s_mso is getting set to *&lt;/P&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:40:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255923#M16038</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T18:40:26Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255924#M16039</link>
      <description>&lt;P&gt;I updated the original answer, try that&lt;/P&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:41:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255924#M16039</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-08-31T18:41:25Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255925#M16040</link>
      <description>&lt;P&gt;Still no joy  &lt;span class="lia-unicode-emoji" title=":disappointed_face:"&gt;😞&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;I included s_mso in the chart header.   &lt;/P&gt;

&lt;P&gt;Here is what it reads&lt;/P&gt;

&lt;P&gt;Expanded Cell Connectivity for - Cox Home Life - CHL *&lt;/P&gt;

&lt;P&gt;s_mso is getting set to *&lt;/P&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:45:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255925#M16040</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T18:45:25Z</dc:date>
    </item>
    <item>
      <title>Re: Condition value using a drilldown</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255926#M16041</link>
      <description>&lt;P&gt;Found it!!!!   Removing the quotes from around $click.value2$ worked!&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;eval token="s_mso"&amp;gt;case($click.value2$="Cox Home Life - CHL", "Cox", $click.value2$="Cox Business Security Solutions - CBSS", "Coxsmb", 1=1, "*"&amp;lt;/eval&amp;gt;     &amp;lt;/condition&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 31 Aug 2016 18:53:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255926#M16041</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2016-08-31T18:53:06Z</dc:date>
    </item>
  </channel>
</rss>

