Problems in drill down

[allan_newton]

This is the basic drill down dashboard.

<![CDATA[
index=core_data | rex field=Message "(?(Started|Failed|COMPLETED))" | table Region, Event_Time, Status
]]>

0
now
15
false
true


/app/data_Monitoring/simple_test?form.host=$row.Region$ | table Region, Message

---

simple_test

host=$click.value$ | table Region, Message

0
now
true
false
none

---

When i click on the first dashboard, I'm redirected to the second dashboard but i get the message "Search Query is not fully resolved"

Please help.

[martin_mueller · Accepted solution]

Your first dashboard is passing a token form.host to the second dashboard, but the search in your second dashboard is referencing a token $click.value$. That token isn't set anywhere, so the search can't run.

Your second dashboard should look something like this: http://docs.splunk.com/Documentation/Splunk/6.0.3/Viz/Dynamicdrilldownindashboardsandforms#Destinati...