Can't unset drilldown token in viz

[mmcg]

Hi,

First time poster here been lurking for too long and I just can't seem to understand where I am going wrong here...

I have created a cluster map that displays the frequency of observed comms with 'bad IPs' . I want to to run a search that will return any IPs that have communicated with the selected bad ip on click, however I'm having an issue unsetting the token for a drilldown, although I am not getting any errors in the XML. It is constantly set at the first value I ever clicked on.

Can anyone see any errors related to the unset in my XML?

Thanks for your help in advance.

<dashboard>
  <label>Bad IPs</label>
  <row>
    <panel>
      <title>Blacklisted IPs Observed</title>
      <map>
        <search>
          <query>| tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic GROUPBY All_Traffic.src_ip 
| rename All_Traffic.src_ip as HostAddress 
| lookup bad_ip.csv HostAddress OUTPUT HostAddress as ip 
| search ip=*
| append 
    [| tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic GROUPBY All_Traffic.dest_ip 
| rename All_Traffic.dest_ip as HostAddress 
| lookup bad_ip.csv HostAddress OUTPUT HostAddress as ip 
| search ip=*]
    | iplocation ip
    | geostats globallimit=0 count by ip</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="mapping.type">marker</option>
        <drilldown>
          <set token="ip_token">$click.name$</set>
          <link target="_blank">search?q=| datamodel Network_Traffic All_Traffic search| search All_Traffic.src_ip=$ip_token|s$ OR All_Traffic.dest_ip=$ip_token|s$
| table All_Traffic.src_ip ,All_Traffic.dest_ip 
| rename All_Traffic.src_ip as Source, All_Traffic.dest_ip as dest_ip 
| stats values(dest_ip) as "Destination" by Source&amp;earliest=-24h@h&amp;latest=now
          <unset token="ip_token"></unset>
        </drilldown>
      </map>
    </panel>
</dashboard>

[niketn]

If your purpose is to get the token from drilldown and use it as a Search input in new link, you need not set and unset token. You can directly use default drilldown token i.e. $click.name$ in the <link>

         <drilldown>
           <link target="_blank">search?q=| datamodel Network_Traffic All_Traffic search| search All_Traffic.src_ip=$click.name|s$ OR All_Traffic.dest_ip=$click.name|s$
 | table All_Traffic.src_ip ,All_Traffic.dest_ip
 | rename All_Traffic.src_ip as Source, All_Traffic.dest_ip as dest_ip
 | stats values(dest_ip) as "Destination" by Source&amp;earliest=-24h@h&amp;latest=now
         </drilldown>

[mmcg]

My mistake I should not have been using $click.name$ as it constantly uses the first field, I had to rewrite my base search.

[niketn]

I think it should be $click.value$ not $click.name$. If you can sample the output of the final table used to plot map, we would be able to confirm the exact default token for the map drilldown.

If you want to figure out on your own, you can refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#map_.28event_tokens.29

[mmcg]

geobin - Lat - Long - IP1 - IP2 - so on
value - laval - lonval - countval - countval

The problem is that whether I use click.value or click.name it always defaults to the first value (i.e IP1.count or IP1.

It appears to be a limitation of geostats, as I would really have expected to get this working in Splunk.

However I'm open to suggestions.