Help with an issue in a drilldown token from a dropdown list

[jip31]

hi

In my dashboard, I use the search below
This search is updated from a dropdown list token (tok_filtersite)

[| inputlookup host.csv 
    | table host] index="x" sourcetype="perfmonmk:process" 
| bucket _time span=3m 
| where process_cpu_used_percent>80 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
**| search SITE=$tok_filtersite|s$** 
| stats dc(process_name) as Total by host 
| sort -Total limit=10

This token is also used in the drilldown associated to my search (where SITE=$SITE$)

[| inputlookup host.csv 
    | table host] index="x" sourcetype="perfmonmk:process" 
| bucket _time span=3m 
| where process_cpu_used_percent>80 
| dedup host process_name 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE COUNTRY TOWN ROOM 
**| where SITE=$SITE$** 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval process_cpu_used_percent=round(process_cpu_used_percent,2). " %" 
| stats latest(time) as time, values(COUNTRY) as COUNTRY, values(TOWN) as TOWN, values(SITE) as SITE, values(ROOM) as ROOM, latest(process_cpu_used_percent) as process_cpu_used_percent by host process_name 
| sort -Total 
| table time host COUNTRY TOWN SITE ROOM process_cpu_used_percent 
| sort -Total

It works perfectly except when I choose * in my dropdown list
If I choose *, the data are well updated in the main dashboard but when I click on my report in order to open the drilldown, this one is empty
What I have to do to display data in my drilldown when I choose * in my dropdown list please??
thanks in advance

[DavidHourani · Accepted solution]

Any chance we can get the xml ?

[jip31]

here is
https://www.cjoint.com/c/IFng3GNCDpb

[jip31]

could it have helped?

[DavidHourani]

hey @jip31, from what I understand the second search is not giving you any results when you use something other than * , is that right ?
Have you tried adding quotes for the token SITE="$SITE$" or escaping it in case there are special characters SITE="$SITE|s$"

[jip31]

hey, yes its right
when i m doing SITE="$SITE$", i have an issue :
"error in where command typechecking failed "" only takes numbers"
and when I m doing SITE="$SITE|s$"
I have another issue
"error in where command the operator at '\"\""' is invalid"

[DavidHourani]

how about replacing :

| where SITE=$SITE$

with this :

| search SITE="$SITE$"

[jip31]

Unfortunately no!
I have tested | search SITE="$SITE$" and | search SITE="$SITE|s$" and it doesn't works....

[jip31]

and if I do | search SITE=Toul* in the drilldown it works

[DavidHourani]

So let's see what's inside the "$SITE$", can you add $SITE$ to the title of the view ? Should show you the result it's giving on the title line 🙂

[DavidHourani]

@jip31, let me know what you see for your token value

[jip31]

hey, I just see $SITE$....

[DavidHourani]

Then run it as the search : | makeresults | eval msg=$SITE$

[jip31]

it's strange, I have the field _time dispalyed!!

[DavidHourani]

so this is your problem 😄 change the token name in the input and try using that, maybe you got two tokens mixed up. And make sure you have |fields yourSiteFieldName populating the value and not just a search.

[jip31]

You mean something like this :
SITE=$TOTO$ | fields TOTO ??