Drilldown not working at all

[mah]

Hi, 

Here is my xml code of 2 pannels :

<panel>
<single>
<search base="abc">
<query>
| eval Duration=round(abs((relative_time(now(), "@d")-relative_time(strptime(Timestamp, "%Y-%m-%dT%H:%M:%S.%N"), "@d"))/86400),0)
| table Duration
| rename Duration
| head 1</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[0,1]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<drilldown>
<link target="_blank">/app/myapp/myapp__details</link>
</drilldown>
</single>
</panel>
<panel>
<single>
<search base="abc">
<query>
| eval dummy="true"
| eval epochnow = now()
| eval epochHorodate=strptime(Horodate, "%Y-%m-%dT%H:%M:%S")| eval Horodate=strftime(epochHorodate, "%Y-%m-%dT%H:%M:%S")
| where epochnow&gt;=epochHorodate
| eval _time=Horodate
| stats count(eval(Statut=="KO")) as KO by _time
| sort _time ASC
| addcoltotals</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
<option name="rangeValues">[0,50]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="unit">KO</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<drilldown>
<link target="_blank">/app/myapp/myapp__details</link>
</drilldown>
</single>
</panel>

The first drilldown works perfectly, but the second which is exactly the same doesn't works at all.

Can you please help me ? 

Thanks.

[niketn · Accepted solution]

@mah your SPL with addcoltotals is adding the sum of KO as total however, it is not having _time field populated for the final row. Since your Single Value viz is looking for _time values as well as the aggregate drilldown is failing for the final row (Single Value shows final row as result for drilldown).

Try replacing the addcoltotals pipe with the following instead and confirm:

| appendpipe 
    [| stats sum(KO) as KO 
    | eval _time=now()]

[mah]

It works great ! I didn't know this subtlety ! 

Thanks for your help.