How do you use a custom field as a token for a drilldown?

[fshimaya]

I have a dashboard that contains a line chart. The query for this is something like:

search ....... | rex field=_raw " (ERROR|E|SEVERE) (?<method>[a-zA-Z0-9\. \-]*)[:\. ]" | timechart count by method limit=10 usenull=f useother=f

The custom field is "method". I would like a drill-down configured so that when the user clicks on either the data point on the chart or the label name, it will take the method value and add it to the query of the "Search" dashboard. So something as simple as:

search $method$

I have tried using $method$ but it literally adds "$method$" to the query. The reason I don't want to use "Auto" feature of the drilldown is that I don't want all the search arguments from the original query added to the drilldown (it's rather long and complicated). I just want the drilldown to have a simple query.

[somesoni2 · Accepted solution]

After you timechart query, there is no field named "method" (instead you'll get a column for each value of field method). Try using $click.name2$ to capture name of the columns which is basically value of the field method.

http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...