Dashboards & Visualizations

How to edit the drilldown values

klim
Path Finder

I have a timechart that is sorted by a variable that is a combination of two fields. Like field1_field2. I want to drilldown and send only field2 to the next dashboard as a token. Is it possible to do some sort of regex on the drilldown value?

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

In your token expression use an eval statement rather than a <set>. Have a look at how this example dashboard does it.

<dashboard>
  <label>split_timechart</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>| makeresults count=100
| streamstats c
| eval _time=_time - c*10
| eval field1=mvindex(split("F1-Value1,F1-Value2,F1-Value3", ","), random() % 3)
| eval field2=mvindex(split("F2-Value1,F2-Value2,F2-Value3", ","), random() % 3)
| eval combined=field1."_".field2
| timechart fixedrange=f span=15s count by combined</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <eval token="field1">mvindex(split($click.name2$,"_"),0)</eval>
          <eval token="field2">mvindex(split($click.name2$,"_"),1)</eval>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <html>
        Clicked value was made from a combination of <b style="color:red">$field1$</b> from field 1 and <b style="color:blue">$field2$</b> from field 2
      </html>
    </panel>
  </row>
</dashboard>

 

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...