Dashboards & Visualizations

After clicking first dashboard, the second dashboard tries to look for corresponding value but ends up with 0

joshimeister
Loves-to-Learn Lots

Hi all,

So I have this issue with tokens. This is probably the first time I work with these.

Basically I have a choropleth map with values already and just want it to display the value in the 2nd dashboard, which is right below the 1st dashboard with the map. The search I have is listed below for the map dashboard along with the token and drilldown sections, this is what I have:

<title>State Map Clone</title>
        <search>
          <query>index=stateindex
| eval US_state=case(like(US_state, "COLORADO") OR like(US_state, "CO"), "Colorado", 
like(US_state, "KANSAS") OR like(US_state, "KS"), "Kansas",
like(US_state, "ALABAMA") OR like(US_state, "AL"), "Alabama",
like(US_state, "ALASKA") OR like(US_state, "AK"), "Alaska",
like(US_state, "ARIZONA") OR like(US_state, "AZ"), "Arizona",
like(US_state, "ARKANSAS") OR like(US_state, "AR"), "Arkansas",
like(US_state, "CALIFORNIA") OR like(US_state, "CA"), "California",
like(US_state, "CONNECTICUT") OR like(US_state, "CT"), "Connecticut",
like(US_state, "DELAWARE") OR like(US_state, "DE"), "Delaware",
like(US_state, "FLORIDA") OR like(US_state, "FL"), "Florida",
like(US_state, "GEORGIA") OR like(US_state, "GA"), "Georgia",
like(US_state, "HAWAII") OR like(US_state, "HI"), "Hawaii",
like(US_state, "IDAHO") OR like(US_state, "ID"), "Idaho",
like(US_state, "ILLINOIS") OR like(US_state, "IL"), "Illinois",
like(US_state, "INDIANA") OR like(US_state, "IN"), "Indiana",
like(US_state, "IOWA") OR like(US_state, "IA"), "Iowa",
like(US_state, "KENTUCKY") OR like(US_state, "KY"), "Kentucky",
like(US_state, "LOUISIANA") OR like(US_state, "LA"), "Louisiana",
like(US_state, "MAINE") OR like(US_state, "ME"), "Maine",
like(US_state, "MARYLAND") OR like(US_state, "MD"), "Maryland",
like(US_state, "MASSACHUSETTS") OR like(US_state, "MA"), "Massachusetts",
like(US_state, "MICHIGAN") OR like(US_state, "MI"), "Michigan",
like(US_state, "MINNESOTA") OR like(US_state, "MN"), "Minnesota",
like(US_state, "MISSISSIPI") OR like(US_state, "MS"), "Mississipi",
like(US_state, "MISSOURI") OR like(US_state, "MO"), "Missouri",
like(US_state, "MONTANA") OR like(US_state, "MT"), "Montana",
like(US_state, "NEBRASKA") OR like(US_state, "NE"), "Nebraska",
like(US_state, "NEVADA") OR like(US_state, "NV"), "Nevada",
like(US_state, "NEW HAMPSHIRE") OR like(US_state, "NH"), "New Hampshire",
like(US_state, "NEW JERSEY") OR like(US_state, "NJ"), "New Jersey",
like(US_state, "NEW MEXICO") OR like(US_state, "NM"), "New Mexico",
| rename US_state AS state
| chart count by state 
| lookup geo_us_states longitude as Longitude, latitude as Latitude 
| geom geo_us_states featureIdField=state allFeatures=true
          <earliest>$Clone.earliest$</earliest>
          <latest>$Clone.latest$</latest>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">all</option>
        <option name="mapping.map.center">(47,250)</option>
        <option name="mapping.map.scrollZoom">1</option>
        <option name="mapping.map.zoom">3</option>
        <option name="mapping.type">choropleth</option>
        <drilldown>
          <set token="state">$click.value$</set>
        </drilldown>
      </map>

For the single value dashboard, here is what I have:

<single>
        <title>State Value For $state$</title>
        <search>
          <query>index=stateIndex earliest=-30d
| eval US_state=case(like(US_state, "COLORADO") OR like(US_state, "CO"), "Colorado", 
like(US_state, "KANSAS") OR like(US_state, "KS"), "Kansas",
like(US_state, "ALABAMA") OR like(US_state, "AL"), "Alabama",
like(US_state, "ALASKA") OR like(US_state, "AK"), "Alaska",
like(US_state, "ARIZONA") OR like(US_state, "AZ"), "Arizona",
like(US_state, "ARKANSAS") OR like(US_state, "AR"), "Arkansas",
like(US_state, "CALIFORNIA") OR like(US_state, "CA"), "California",
like(US_state, "CONNECTICUT") OR like(US_state, "CT"), "Connecticut",
like(US_state, "DELAWARE") OR like(US_state, "DE"), "Delaware",
like(US_state, "FLORIDA") OR like(US_state, "FL"), "Florida",
like(US_state, "GEORGIA") OR like(US_state, "GA"), "Georgia",
like(US_state, "HAWAII") OR like(US_state, "HI"), "Hawaii",
like(US_state, "IDAHO") OR like(US_state, "ID"), "Idaho",
like(US_state, "ILLINOIS") OR like(US_state, "IL"), "Illinois",
like(US_state, "INDIANA") OR like(US_state, "IN"), "Indiana",
like(US_state, "IOWA") OR like(US_state, "IA"), "Iowa",
like(US_state, "KENTUCKY") OR like(US_state, "KY"), "Kentucky",
like(US_state, "LOUISIANA") OR like(US_state, "LA"), "Louisiana",
like(US_state, "MAINE") OR like(US_state, "ME"), "Maine",
like(US_state, "MARYLAND") OR like(US_state, "MD"), "Maryland",
like(US_state, "MASSACHUSETTS") OR like(US_state, "MA"), "Massachusetts",
like(US_state, "MICHIGAN") OR like(US_state, "MI"), "Michigan",
like(US_state, "MINNESOTA") OR like(US_state, "MN"), "Minnesota",
like(US_state, "MISSISSIPI") OR like(US_state, "MS"), "Mississipi",
like(US_state, "MISSOURI") OR like(US_state, "MO"), "Missouri",
like(US_state, "MONTANA") OR like(US_state, "MT"), "Montana",
like(US_state, "NEBRASKA") OR like(US_state, "NE"), "Nebraska",
like(US_state, "NEVADA") OR like(US_state, "NV"), "Nevada",
like(US_state, "NEW HAMPSHIRE") OR like(US_state, "NH"), "New Hampshire",
like(US_state, "NEW JERSEY") OR like(US_state, "NJ"), "New Jersey",
like(US_state, "NEW MEXICO") OR like(US_state, "NM"), "New Mexico",
| rename US_state AS state
| chart count by state 
| lookup geo_us_states longitude as Longitude, latitude as Latitude 
| geom geo_us_states featureIdField=state allFeatures=true
| search featureId=$state$
| stats count
          <earliest>-30d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="state">$click.value$</set>
        </drilldown>
      </single>
    </panel>

Is there anything wrong here? I can't seem to figure it out. It seems like as soon as I click the US state in the 1st dashboard, the 2nd dashboard is trying to look for the corresponding value but it keeps ending up with a 0. I know I'm missing something here and I am sensing it's going to be something silly.

Any help? thanks

Below is an example of what happens when I click, say, Colorado.

alt text

0 Karma

woodcock
Esteemed Legend

Install the Dashboard Examples app and create a true custom drilldown based on the closest example to do exactly what you would like it to do:
https://splunkbase.splunk.com/app/1603/

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...