Dashboards & Visualizations

Problem with map command and drilldown.

baklimek
New Member

So I have a drill down on my first table where you're able to select a value in the MaterialName field and it's suppose to link to the second search using $WOSet$. However, when I click the cell of the MaterialName on the first table, the token doesn’t connect to the second table below it because the second table uses a map function that uses a token from its own search in its subsearch. (If you take out the part with the map function, the drilldown does work) How would I be able to overcome this so that the drilldown would work properly? I tried the double $$ around the tokens, but that doesn't seem to work. When I click the value In the first panel it the second panel isn't even affected. The second panel just says search is waiting for an input

This is my code:

       <row>
            <panel>
              <table>
                <search>
                  <query>index="database1" 
        | stats first(Status) as Stat first(PromiseDate) as PromiseDate first(Quantity) as Qty by WorkOrderNumber,MaterialName
        | table PromiseDate WorkOrderNumber Stat MaterialName Qty
        | dedup WorkOrderNumber consecutive=false</query>
                  <earliest>-7d</earliest>
                  <latest>+3d</latest>
                  <sampleRatio>1</sampleRatio>
                </search>
                <option name="count">100</option>
                <option name="dataOverlayMode">none</option>
                <option name="drilldown">cell</option>
                <option name="percentagesRow">false</option>
                <option name="rowNumbers">false</option>
                <option name="totalsRow">false</option>
                <option name="wrap">true</option>
                <drilldown>
                  <set token="WOSet">$click.value2$</set>
                </drilldown>
              </table>
            </panel>
          </row>
          <row>
            <panel>
              <table>
                <search>
                  <query> index="databaseorderhistory"  MaterialName="$$WOSet$$"
        | stats first(Status) as Stat first(PromiseDate) as PromiseDate by WorkOrderNumber,MaterialName
        | dedup WorkOrderNumber consecutive=false
        | join type=left MaterialName [search index="plth5_googlesheets" source="http:H5_RoughMill_Inputs"
        |table Sku InputMaterial
        | rename Sku as MaterialName
        | dedup InputMaterial
        |eval timenow=relative_time(now(),"-5d@M")
        | map maxsearches=100 search="search index=database2 ProductName="$$InputMaterial$$" 
        | stats first(postQty) as Qty first(type) as Type first(PlantNumber) as LastLocation first(postLocationName) as LocationNo last(PlantNumber) as ProducedLocation first(_time) as Date last(_time) as ProduceTime last(type) as ProducedType by postName, ProductName  
        | where Qty>0
        |eval timenow=\"$timenow$\""
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...