<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Drilldown eval token statement does not work unless broken into two steps - why?? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-doesn-t-drilldown-eval-token-statement-work-unless-broken/m-p/626899#M51390</link>
    <description>&lt;P&gt;I thought it might be eval not being able to process more than one $row.xxx$ field but it isn't that - I updated your example to use mvzip to prove it - looks like a bug to me&amp;nbsp;&lt;span class="lia-unicode-emoji" title=":grinning_face:"&gt;😀&lt;/span&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;dashboard&amp;gt;
  &amp;lt;label&amp;gt;MV Click&amp;lt;/label&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults
| fields - _time
| eval name=split("ABCDEFGHIJKL", "")
| eval key=lower(name)
| table name key&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;@d&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
          &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;fields&amp;gt;name&amp;lt;/fields&amp;gt;
        &amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;
        &amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;
        &amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
        &amp;lt;drilldown&amp;gt;
          &amp;lt;eval token="k1"&amp;gt;mvindex($row.key$, int(mvfind($row.name$, $click.value2$)))&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="k2"&amp;gt;mvfind($row.name$, $click.value2$)&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="k3"&amp;gt;mvindex($row.key$, $k2$)&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="k4"&amp;gt;mvzip($row.key$,$row.name$,"|")&amp;lt;/eval&amp;gt;
          &amp;lt;set token="name"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
          &amp;lt;set token="names"&amp;gt;$row.name$&amp;lt;/set&amp;gt;
          &amp;lt;set token="keys"&amp;gt;$row.key$&amp;lt;/set&amp;gt;
        &amp;lt;/drilldown&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;html&amp;gt;
        &amp;lt;h2&amp;gt;Clicked name=$name$&amp;lt;/h2&amp;gt;&amp;lt;p/&amp;gt;
        &amp;lt;h2&amp;gt;Names=$names$&amp;lt;/h2&amp;gt;
        &amp;lt;h2&amp;gt;Keys=$keys$&amp;lt;/h2&amp;gt;&amp;lt;p/&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k1"&amp;gt;mvindex($row.key$, mvfind($row.name$, $click.value2$))&amp;amp;lt;/eval&amp;gt; = $k1$&amp;lt;/h3&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k2"&amp;gt;mvfind($row.name$, $click.value2$)&amp;amp;lt;/eval&amp;gt; = $k2$&amp;lt;/h3&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k3"&amp;gt;mvindex($row.key$, $$k2$$)&amp;amp;lt;/eval&amp;gt; = $k3$&amp;lt;/h3&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k4"&amp;gt;mvzip($row.key$,$row.name$,"|")&amp;amp;lt;/eval&amp;gt; = $k4$&amp;lt;/h3&amp;gt;
      &amp;lt;/html&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/dashboard&amp;gt;&lt;/LI-CODE&gt;</description>
    <pubDate>Thu, 12 Jan 2023 10:52:22 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2023-01-12T10:52:22Z</dc:date>
    <item>
      <title>Why doesn't drilldown eval token statement work unless broken into two steps?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-doesn-t-drilldown-eval-token-statement-work-unless-broken/m-p/626877#M51388</link>
      <description>&lt;P&gt;&lt;SPAN&gt;Can anyone explain why the k1 eval token statement does not work, but k2 and k3, which do the same as k1, but in two steps, does.&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;&amp;lt;eval token="k1"&amp;gt;mvindex($row.key$, mvfind($row.name$, $click.value2$))&amp;lt;/eval&amp;gt;
&amp;lt;eval token="k2"&amp;gt;mvfind($row.name$, $click.value2$)&amp;lt;/eval&amp;gt;
&amp;lt;eval token="k3"&amp;gt;mvindex($row.key$, $k2$)&amp;lt;/eval&amp;gt;&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;Requirements are: 2 MV fields in a single row with keys in one field and names in the other. drilldown is cell and click.value2 is the clicked name (key column is hidden).&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;I'm trying to grab the corresponding key for the clicked name. I finally got k2/k3 combination working, but am puzzled why k1 does not work and don't know how to diagnose.&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;Here's an example dashboard.&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;&amp;lt;dashboard&amp;gt;
  &amp;lt;label&amp;gt;MV Click&amp;lt;/label&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults
| fields - _time
| eval name=split("ABCDEFGHIJKL", "")
| eval key=lower(name)
| table name key&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;@d&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
          &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;fields&amp;gt;name&amp;lt;/fields&amp;gt;
        &amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;
        &amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;
        &amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
        &amp;lt;drilldown&amp;gt;
          &amp;lt;eval token="k1"&amp;gt;mvindex($row.key$, mvfind($row.name$, $click.value2$))&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="k2"&amp;gt;mvfind($row.name$, $click.value2$)&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="k3"&amp;gt;mvindex($row.key$, $k2$)&amp;lt;/eval&amp;gt;
          &amp;lt;set token="name"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
          &amp;lt;set token="names"&amp;gt;$row.name$&amp;lt;/set&amp;gt;
          &amp;lt;set token="keys"&amp;gt;$row.key$&amp;lt;/set&amp;gt;
        &amp;lt;/drilldown&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;html&amp;gt;
        &amp;lt;h2&amp;gt;Clicked name=$name$&amp;lt;/h2&amp;gt;&amp;lt;p/&amp;gt;
        &amp;lt;h2&amp;gt;Names=$names$&amp;lt;/h2&amp;gt;
        &amp;lt;h2&amp;gt;Keys=$keys$&amp;lt;/h2&amp;gt;&amp;lt;p/&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k1"&amp;gt;mvindex($row.key$, mvfind($row.name$, $click.value2$))&amp;amp;lt;/eval&amp;gt; = $k1$&amp;lt;/h3&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k2"&amp;gt;mvfind($row.name$, $click.value2$)&amp;amp;lt;/eval&amp;gt; = $k2$&amp;lt;/h3&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k3"&amp;gt;mvindex($row.key$, $$k2$$)&amp;amp;lt;/eval&amp;gt; = $k3$&amp;lt;/h3&amp;gt;
      &amp;lt;/html&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/dashboard&amp;gt;&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 12 Jan 2023 19:28:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Why-doesn-t-drilldown-eval-token-statement-work-unless-broken/m-p/626877#M51388</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2023-01-12T19:28:22Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown eval token statement does not work unless broken into two steps - why??</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-doesn-t-drilldown-eval-token-statement-work-unless-broken/m-p/626899#M51390</link>
      <description>&lt;P&gt;I thought it might be eval not being able to process more than one $row.xxx$ field but it isn't that - I updated your example to use mvzip to prove it - looks like a bug to me&amp;nbsp;&lt;span class="lia-unicode-emoji" title=":grinning_face:"&gt;😀&lt;/span&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;dashboard&amp;gt;
  &amp;lt;label&amp;gt;MV Click&amp;lt;/label&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults
| fields - _time
| eval name=split("ABCDEFGHIJKL", "")
| eval key=lower(name)
| table name key&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;@d&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
          &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;fields&amp;gt;name&amp;lt;/fields&amp;gt;
        &amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;
        &amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;
        &amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
        &amp;lt;drilldown&amp;gt;
          &amp;lt;eval token="k1"&amp;gt;mvindex($row.key$, int(mvfind($row.name$, $click.value2$)))&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="k2"&amp;gt;mvfind($row.name$, $click.value2$)&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="k3"&amp;gt;mvindex($row.key$, $k2$)&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="k4"&amp;gt;mvzip($row.key$,$row.name$,"|")&amp;lt;/eval&amp;gt;
          &amp;lt;set token="name"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
          &amp;lt;set token="names"&amp;gt;$row.name$&amp;lt;/set&amp;gt;
          &amp;lt;set token="keys"&amp;gt;$row.key$&amp;lt;/set&amp;gt;
        &amp;lt;/drilldown&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;html&amp;gt;
        &amp;lt;h2&amp;gt;Clicked name=$name$&amp;lt;/h2&amp;gt;&amp;lt;p/&amp;gt;
        &amp;lt;h2&amp;gt;Names=$names$&amp;lt;/h2&amp;gt;
        &amp;lt;h2&amp;gt;Keys=$keys$&amp;lt;/h2&amp;gt;&amp;lt;p/&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k1"&amp;gt;mvindex($row.key$, mvfind($row.name$, $click.value2$))&amp;amp;lt;/eval&amp;gt; = $k1$&amp;lt;/h3&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k2"&amp;gt;mvfind($row.name$, $click.value2$)&amp;amp;lt;/eval&amp;gt; = $k2$&amp;lt;/h3&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k3"&amp;gt;mvindex($row.key$, $$k2$$)&amp;amp;lt;/eval&amp;gt; = $k3$&amp;lt;/h3&amp;gt;
        &amp;lt;h3&amp;gt;&amp;amp;lt;eval token="k4"&amp;gt;mvzip($row.key$,$row.name$,"|")&amp;amp;lt;/eval&amp;gt; = $k4$&amp;lt;/h3&amp;gt;
      &amp;lt;/html&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/dashboard&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Thu, 12 Jan 2023 10:52:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Why-doesn-t-drilldown-eval-token-statement-work-unless-broken/m-p/626899#M51390</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2023-01-12T10:52:22Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown eval token statement does not work unless broken into two steps - why??</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-doesn-t-drilldown-eval-token-statement-work-unless-broken/m-p/626988#M51394</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;I posted also on Slack and&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/193600"&gt;@jeffland&lt;/a&gt;&amp;nbsp;did a great job of working out what the issue is.&amp;nbsp;&lt;/P&gt;&lt;P&gt;In the JS that evaluates the mvfind() in the k1 case, it returns a data type of mv, which then silently throws an error when it's passed to mvindex(). The solution in that case is to force it into a number by wrapping it in&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;eval token="k1"&amp;gt;mvindex($row.key$, tonumber(tostring(mvfind($row.name$, $click.value2$)))))&amp;lt;/eval&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;so yes it does appear to be a bug - I have occasionally found eval token setters not to work and never understood why. I tagged you in the slack channel dashboards_simple_xml&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 12 Jan 2023 23:00:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Why-doesn-t-drilldown-eval-token-statement-work-unless-broken/m-p/626988#M51394</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2023-01-12T23:00:27Z</dc:date>
    </item>
  </channel>
</rss>

