Dashboards & Visualizations

Problem with map command and drilldown.

baklimek
New Member

So I have a drill down on my first table where you're able to select a value in the MaterialName field and it's suppose to link to the second search using $WOSet$. However, when I click the cell of the MaterialName on the first table, the token doesn’t connect to the second table below it because the second table uses a map function that uses a token from its own search in its subsearch. (If you take out the part with the map function, the drilldown does work) How would I be able to overcome this so that the drilldown would work properly? I tried the double $$ around the tokens, but that doesn't seem to work. When I click the value In the first panel it the second panel isn't even affected. The second panel just says search is waiting for an input

This is my code:

       <row>
            <panel>
              <table>
                <search>
                  <query>index="database1" 
        | stats first(Status) as Stat first(PromiseDate) as PromiseDate first(Quantity) as Qty by WorkOrderNumber,MaterialName
        | table PromiseDate WorkOrderNumber Stat MaterialName Qty
        | dedup WorkOrderNumber consecutive=false</query>
                  <earliest>-7d</earliest>
                  <latest>+3d</latest>
                  <sampleRatio>1</sampleRatio>
                </search>
                <option name="count">100</option>
                <option name="dataOverlayMode">none</option>
                <option name="drilldown">cell</option>
                <option name="percentagesRow">false</option>
                <option name="rowNumbers">false</option>
                <option name="totalsRow">false</option>
                <option name="wrap">true</option>
                <drilldown>
                  <set token="WOSet">$click.value2$</set>
                </drilldown>
              </table>
            </panel>
          </row>
          <row>
            <panel>
              <table>
                <search>
                  <query> index="databaseorderhistory"  MaterialName="$$WOSet$$"
        | stats first(Status) as Stat first(PromiseDate) as PromiseDate by WorkOrderNumber,MaterialName
        | dedup WorkOrderNumber consecutive=false
        | join type=left MaterialName [search index="plth5_googlesheets" source="http:H5_RoughMill_Inputs"
        |table Sku InputMaterial
        | rename Sku as MaterialName
        | dedup InputMaterial
        |eval timenow=relative_time(now(),"-5d@M")
        | map maxsearches=100 search="search index=database2 ProductName="$$InputMaterial$$" 
        | stats first(postQty) as Qty first(type) as Type first(PlantNumber) as LastLocation first(postLocationName) as LocationNo last(PlantNumber) as ProducedLocation first(_time) as Date last(_time) as ProduceTime last(type) as ProducedType by postName, ProductName  
        | where Qty>0
        |eval timenow=\"$timenow$\""
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...