Dashboards & Visualizations

Problem with command "map"

pamcarvalho
Path Finder

Hey guys!

So, I am having issues with the command map and was hoping someone can help me with this..
I have a Choropleth Map that displays number of events per country according to a search string. What I am trying to do is: drilldown the country name and the user name (from a multiselect input used to populate the map) once the person clicks on it to a Statistic Table. Problem is, in this table, I am also using the map command.
Here is an example of how my search looks like, more or less:

index=myindex | iplocation ip_address | search user="$UserDD$" AND Country="$PEC$" | map search="search index=myindex hash=$$hash$$" maxsearches=100 | stats ....."

I keep getting the error message "Error in 'map': Did not find value for required attribute 'hash'."
I already tried "$hash$", doesn't work..

PS: it works just fine if I put a country name (example: Brazil) and "hash" with only one two $ ("$hash$").

Can anyone please help me?
Thank you very much!!

0 Karma
1 Solution

pamcarvalho
Path Finder

Recaptulating: I had only one multiselect input, that was feeding two Choropleth Maps and two Statistic Tables. The Statistic Tables mentioned, were getting information from the Choropleth Maps to give more information. These Tables had three drilldowns in the search string: the country one (when you click the Map), the user one (from the multiselect) and the hash one (map command).

The problem was the multiselect input. I am not sure why, but after l put another multiselect (one multiselect input for one Choropleth Map and one Statistic Table, and another one for the other two), it started working just fine! I really wanted to make it all work with just one multiselect feeding with users, but it's fine.

View solution in original post

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...