How to edit the drilldown values

[klim]

I have a timechart that is sorted by a variable that is a combination of two fields. Like field1_field2. I want to drilldown and send only field2 to the next dashboard as a token. Is it possible to do some sort of regex on the drilldown value?

[bowesmana]

In your token expression use an eval statement rather than a <set>. Have a look at how this example dashboard does it.

<dashboard>
  <label>split_timechart</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>| makeresults count=100
| streamstats c
| eval _time=_time - c*10
| eval field1=mvindex(split("F1-Value1,F1-Value2,F1-Value3", ","), random() % 3)
| eval field2=mvindex(split("F2-Value1,F2-Value2,F2-Value3", ","), random() % 3)
| eval combined=field1."_".field2
| timechart fixedrange=f span=15s count by combined</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <eval token="field1">mvindex(split($click.name2$,"_"),0)</eval>
          <eval token="field2">mvindex(split($click.name2$,"_"),1)</eval>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <html>
        Clicked value was made from a combination of <b style="color:red">$field1$</b> from field 1 and <b style="color:blue">$field2$</b> from field 2
      </html>
    </panel>
  </row>
</dashboard>