Dashboards & Visualizations

PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'rangemap' command

alenseb
Communicator

Hi,

I am getting this error while trying to drilldown.
How do i escape this issue as i need to use RangeMap.

This is the code i am using:
sourcetype="Log1" | join type=inner UsrName [SEARCH sourcetype="Log2"] | rangemap field=count green=0-4 blue=5-20 red=21-50 default=red

Please Help.
Thanks!

Tags (2)
1 Solution

MarioM
Motivator

in drilldown rangemap,fieldformat,eval,... cannot be the last search command then you need add another search command ie |stats, |table,...

View solution in original post

MarioM
Motivator

in drilldown rangemap,fieldformat,eval,... cannot be the last search command then you need add another search command ie |stats, |table,...

Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...