How do you manipulate a token before passing it to a drilldown?

[splunkrocks2014]

How do you manipulate a token before passing it to a drilldown?

For example, the following dashboard has a a statistic table with a field, country with value "United States of America (USA)", and I just want to pass "USA" to the drilldown. But the token ("country") is not changed to "USA" from the eval function when passed to the deep link. Any clues? Thanks.

<dashboard>
  <label>testing</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval Country="United States of America (USA)"
| table Country</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <eval token="country">replace(replace(mvindex(split($click.value$," "),-1,-1),"\(",""),"\)","")</eval>
          <link target="_blank">
            <![CDATA[https://en.wikipedia.org/wiki/$country$]]>
          </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

[renjith_nair · Accepted solution]

@splunkrocks2014 ,

It's possible to change but why don't you extract in the search itself? For e.g.

<dashboard>
  <label>testing</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval Country="United States of America (USA)"
| rex field="Country" "\((?<_C>.*)\)"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">
            <![CDATA[https://en.wikipedia.org/wiki/$row._C$]]>
          </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

[splunkrocks2014]

Never thought about this way 🙂 ... thanks.