How to get field value and post it in link (Dashboard)?

[sbimizry]

Hi, from search ...| timechart count by status maked spikes diagram in dashboard.
Example output search:
_time 200 300 400
08/09/19 5 8 4
08/07/19 1 3 7

How to get status name (200, 300, 400) and set it in link...

<drilldown>
  <link>/apps/dashboard?form.field=$click.statusname$</link>
</drilldown>

Note:

row not worked, only all or none
$click.name$ - return field name '_time'
$click.name2$ - return field name 'count'
$click.value$ - return value field _time
$click.value$ - return value field count

[woodcock]

You are not making sense. I used this run-anywhere search:

index=_* sourcetype=*access
|  timechart count BY status

And saved it as a dashboard panel with the Line chart visualization.
When I clicked Edit -> -> Edit drilldown and set On click to Link to search and Auto, It correctly used status=$click.name2$ as the drilldown search segment. Futhermore, if changed from Auto to Custom and used this drilldown search:

| makeresults 
| eval name="$click.name$", value="$click.value$", name2="$click.name2$", value2="$click.value2$"

I get this:

| makeresults | eval name="_time", value="1565974800.000", name2="200", value2="1014"

Which also confirms that the correct token is $click.name2$. This absolutely, positively, unquestionably IS the right answer.

[niketn]

@sbimizry try predefined drilldown token $click.name2$ as per the documentation.

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#Predefined_dr...

[sbimizry]

I diding it, not worked...
$click.name2$ - return field name 'count'
$click.name$ - return field name '_time'
$click.value$ - return field value '10/08/19 16:25' (one word - time)
$click.value$ - return field value count (5, 8, 4 etc)
Maybe there are other ideas?