Dashboards & Visualizations

Problem with map command and drilldown.

baklimek
New Member

So I have a drill down on my first table where you're able to select a value in the MaterialName field and it's suppose to link to the second search using $WOSet$. However, when I click the cell of the MaterialName on the first table, the token doesn’t connect to the second table below it because the second table uses a map function that uses a token from its own search in its subsearch. (If you take out the part with the map function, the drilldown does work) How would I be able to overcome this so that the drilldown would work properly? I tried the double $$ around the tokens, but that doesn't seem to work. When I click the value In the first panel it the second panel isn't even affected. The second panel just says search is waiting for an input

This is my code:

       <row>
            <panel>
              <table>
                <search>
                  <query>index="database1" 
        | stats first(Status) as Stat first(PromiseDate) as PromiseDate first(Quantity) as Qty by WorkOrderNumber,MaterialName
        | table PromiseDate WorkOrderNumber Stat MaterialName Qty
        | dedup WorkOrderNumber consecutive=false</query>
                  <earliest>-7d</earliest>
                  <latest>+3d</latest>
                  <sampleRatio>1</sampleRatio>
                </search>
                <option name="count">100</option>
                <option name="dataOverlayMode">none</option>
                <option name="drilldown">cell</option>
                <option name="percentagesRow">false</option>
                <option name="rowNumbers">false</option>
                <option name="totalsRow">false</option>
                <option name="wrap">true</option>
                <drilldown>
                  <set token="WOSet">$click.value2$</set>
                </drilldown>
              </table>
            </panel>
          </row>
          <row>
            <panel>
              <table>
                <search>
                  <query> index="databaseorderhistory"  MaterialName="$$WOSet$$"
        | stats first(Status) as Stat first(PromiseDate) as PromiseDate by WorkOrderNumber,MaterialName
        | dedup WorkOrderNumber consecutive=false
        | join type=left MaterialName [search index="plth5_googlesheets" source="http:H5_RoughMill_Inputs"
        |table Sku InputMaterial
        | rename Sku as MaterialName
        | dedup InputMaterial
        |eval timenow=relative_time(now(),"-5d@M")
        | map maxsearches=100 search="search index=database2 ProductName="$$InputMaterial$$" 
        | stats first(postQty) as Qty first(type) as Type first(PlantNumber) as LastLocation first(postLocationName) as LocationNo last(PlantNumber) as ProducedLocation first(_time) as Date last(_time) as ProduceTime last(type) as ProducedType by postName, ProductName  
        | where Qty>0
        |eval timenow=\"$timenow$\""
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...