Dashboards & Visualizations

Problem with map command and drilldown.

baklimek
New Member

So I have a drill down on my first table where you're able to select a value in the MaterialName field and it's suppose to link to the second search using $WOSet$. However, when I click the cell of the MaterialName on the first table, the token doesn’t connect to the second table below it because the second table uses a map function that uses a token from its own search in its subsearch. (If you take out the part with the map function, the drilldown does work) How would I be able to overcome this so that the drilldown would work properly? I tried the double $$ around the tokens, but that doesn't seem to work. When I click the value In the first panel it the second panel isn't even affected. The second panel just says search is waiting for an input

This is my code:

       <row>
            <panel>
              <table>
                <search>
                  <query>index="database1" 
        | stats first(Status) as Stat first(PromiseDate) as PromiseDate first(Quantity) as Qty by WorkOrderNumber,MaterialName
        | table PromiseDate WorkOrderNumber Stat MaterialName Qty
        | dedup WorkOrderNumber consecutive=false</query>
                  <earliest>-7d</earliest>
                  <latest>+3d</latest>
                  <sampleRatio>1</sampleRatio>
                </search>
                <option name="count">100</option>
                <option name="dataOverlayMode">none</option>
                <option name="drilldown">cell</option>
                <option name="percentagesRow">false</option>
                <option name="rowNumbers">false</option>
                <option name="totalsRow">false</option>
                <option name="wrap">true</option>
                <drilldown>
                  <set token="WOSet">$click.value2$</set>
                </drilldown>
              </table>
            </panel>
          </row>
          <row>
            <panel>
              <table>
                <search>
                  <query> index="databaseorderhistory"  MaterialName="$$WOSet$$"
        | stats first(Status) as Stat first(PromiseDate) as PromiseDate by WorkOrderNumber,MaterialName
        | dedup WorkOrderNumber consecutive=false
        | join type=left MaterialName [search index="plth5_googlesheets" source="http:H5_RoughMill_Inputs"
        |table Sku InputMaterial
        | rename Sku as MaterialName
        | dedup InputMaterial
        |eval timenow=relative_time(now(),"-5d@M")
        | map maxsearches=100 search="search index=database2 ProductName="$$InputMaterial$$" 
        | stats first(postQty) as Qty first(type) as Type first(PlantNumber) as LastLocation first(postLocationName) as LocationNo last(PlantNumber) as ProducedLocation first(_time) as Date last(_time) as ProduceTime last(type) as ProducedType by postName, ProductName  
        | where Qty>0
        |eval timenow=\"$timenow$\""
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...