https://community.splunk.com/t5/Dashboards-Visualizations/Problems-in-drill-down/m-p/144263#M8735 <P>This is the basic drill down dashboard.</P> <P><DASHBOARD><BR /> <ROW> <BR /> <TABLE><BR /> <TITLE>Drill_Here</TITLE><BR /> <SEARCHSTRING><BR /> &lt;![CDATA[<BR /> index=core_data | rex field=Message "(?<STATUS>(Started|Failed|COMPLETED))" | table Region, Event_Time, Status<BR /> ]]&gt;<BR /> </STATUS><BR /> <EARLIESTTIME>0</EARLIESTTIME><BR /> <LATESTTIME>now</LATESTTIME><BR /> 15<BR /> false<BR /> true<BR /> <DRILLDOWN target="simple_test"><BR /> <LINK /><BR /> /app/data_Monitoring/simple_test?form.host=$row.Region$ | table Region, Message<BR /> <BR /> </DRILLDOWN><BR /><BR /> </SEARCHSTRING></TABLE><BR /> </ROW><BR /> </DASHBOARD></P> <HR /> <P><DASHBOARD><BR /> <LABEL>simple_test</LABEL><BR /> <ROW><BR /> <TABLE><BR /> <TITLE>Drilled_Here</TITLE><BR /> <SEARCHSTRING> host=$click.value$ | table Region, Message<BR /> </SEARCHSTRING><BR /> <EARLIESTTIME>0</EARLIESTTIME><BR /> <LATESTTIME>now</LATESTTIME><BR /> true<BR /> false<BR /> none<BR /> </TABLE><BR /> </ROW><BR /> </DASHBOARD></P> <HR /> <P>When i click on the first dashboard, I'm redirected to the second dashboard but i get the message "Search Query is not fully resolved"</P> <P>Please help.</P> Mon, 28 Sep 2020 16:28:51 GMT allan_newton 2020-09-28T16:28:51Z https://community.splunk.com/t5/Dashboards-Visualizations/Problems-in-drill-down/m-p/144263#M8735 <P>This is the basic drill down dashboard.</P> <P><DASHBOARD><BR /> <ROW> <BR /> <TABLE><BR /> <TITLE>Drill_Here</TITLE><BR /> <SEARCHSTRING><BR /> &lt;![CDATA[<BR /> index=core_data | rex field=Message "(?<STATUS>(Started|Failed|COMPLETED))" | table Region, Event_Time, Status<BR /> ]]&gt;<BR /> </STATUS><BR /> <EARLIESTTIME>0</EARLIESTTIME><BR /> <LATESTTIME>now</LATESTTIME><BR /> 15<BR /> false<BR /> true<BR /> <DRILLDOWN target="simple_test"><BR /> <LINK /><BR /> /app/data_Monitoring/simple_test?form.host=$row.Region$ | table Region, Message<BR /> <BR /> </DRILLDOWN><BR /><BR /> </SEARCHSTRING></TABLE><BR /> </ROW><BR /> </DASHBOARD></P> <HR /> <P><DASHBOARD><BR /> <LABEL>simple_test</LABEL><BR /> <ROW><BR /> <TABLE><BR /> <TITLE>Drilled_Here</TITLE><BR /> <SEARCHSTRING> host=$click.value$ | table Region, Message<BR /> </SEARCHSTRING><BR /> <EARLIESTTIME>0</EARLIESTTIME><BR /> <LATESTTIME>now</LATESTTIME><BR /> true<BR /> false<BR /> none<BR /> </TABLE><BR /> </ROW><BR /> </DASHBOARD></P> <HR /> <P>When i click on the first dashboard, I'm redirected to the second dashboard but i get the message "Search Query is not fully resolved"</P> <P>Please help.</P> Mon, 28 Sep 2020 16:28:51 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Problems-in-drill-down/m-p/144263#M8735 allan_newton 2020-09-28T16:28:51Z https://community.splunk.com/t5/Dashboards-Visualizations/Problems-in-drill-down/m-p/144264#M8736 <P>Your first dashboard is passing a token <CODE>form.host</CODE> to the second dashboard, but the search in your second dashboard is referencing a token <CODE>$click.value$</CODE>. That token isn't set anywhere, so the search can't run.</P> <P>Your second dashboard should look something like this: <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/Viz/Dynamicdrilldownindashboardsandforms#Destination_form">http://docs.splunk.com/Documentation/Splunk/6.0.3/Viz/Dynamicdrilldownindashboardsandforms#Destination_form</A></P> Mon, 28 Apr 2014 20:13:34 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Problems-in-drill-down/m-p/144264#M8736 martin_mueller 2014-04-28T20:13:34Z