https://community.splunk.com/t5/Dashboards-Visualizations/Does-Splunk-Drilldown-actually-work/m-p/42015#M2024 <P>Looks like drilldown works ok on single source searches. My situation is the search contains two sources joined together throgh different columns using eval and sub search as following:</P> <P>source="sample1.csv"| eval joinid=if(isnotnull(key), key, "Incident") | join joinid [search source="sample2.csv"| eval joinid=if(isnotnull(Key), Key, "Jira")] | bucket _time span=1h | stats count as incidents, count(Key) as jiras, count(Issue_Links) as clonedjira by _time</P> <P>Anyway can drill down from on this search?</P> Mon, 28 Sep 2020 11:46:10 GMT yiguanghu 2020-09-28T11:46:10Z https://community.splunk.com/t5/Dashboards-Visualizations/Does-Splunk-Drilldown-actually-work/m-p/42014#M2023 <P>I have a stats that shows count of several columns by _time. It shows the timeline and table correctly. But when I clicked the green bar to drill down, It always show 0 results. Please let me know what am I missing?</P> Wed, 02 May 2012 18:41:18 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Does-Splunk-Drilldown-actually-work/m-p/42014#M2023 yiguanghu 2012-05-02T18:41:18Z https://community.splunk.com/t5/Dashboards-Visualizations/Does-Splunk-Drilldown-actually-work/m-p/42015#M2024 <P>Looks like drilldown works ok on single source searches. My situation is the search contains two sources joined together throgh different columns using eval and sub search as following:</P> <P>source="sample1.csv"| eval joinid=if(isnotnull(key), key, "Incident") | join joinid [search source="sample2.csv"| eval joinid=if(isnotnull(Key), Key, "Jira")] | bucket _time span=1h | stats count as incidents, count(Key) as jiras, count(Issue_Links) as clonedjira by _time</P> <P>Anyway can drill down from on this search?</P> Mon, 28 Sep 2020 11:46:10 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Does-Splunk-Drilldown-actually-work/m-p/42015#M2024 yiguanghu 2020-09-28T11:46:10Z