How do I pass value of a specific field as a token to next search with drilldown?

[varad_joshi]

I want to pass the Country name when I click on my map. Country is one of the fields in the data. Say if I click on Keyna, I want Kenya to be passed as a token on the next search.

Here is what I am doing -

I have an inputlookup file where I have the list of countries and the coordinates.
Then on my index, I have the list of few countries. Running a join on lookup file and the indexed data.

Here is my search:

|inputlookup Countries.csv | join type=inner [search index=crm] | geostats latfield=latitude longfield=longitude binspanlat=1 binspanlong=1 count

This gets me the Blue dots on the map based on the indexed data. However I am not able to run the count by command.

Also I would like if the Name of the country appears next to the dot on the map.

Later, I want to know how to pass a specific field's value when I click on the Country. I want to pass the country name to next search. I know how to pass a token, I need to know how to pass a value from a specific field.

SOS!!!

[niketn]

You need to code row.<YourFieldName> not result.<YourFieldName>

Code the map's <drilldown> event to capture field value of the clicked marker using row.<YourFieldName>

Refer to Splunk documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#map_.28event_t...

[aholzel]

In thought it was something like $click.$ so in this case $click.Country$