Splunk Dashboard Studio maps not capture click

[arlissilva]

Hello, I am building a dashboard in Splunk Enterprise, I included the map with the Choropleth layer type and that worked for me, but I have a table that performs a query based on the region clicked on the map and that part does not work in Splunk Dashboard Studio. I have already defined the token on the map, adjusted the token in the table's query, and it seems that it does not capture the clicked area. I did the same process in Splunk Classic and it worked as expected.

below is the source code of the MAP

{
    "dataSources": {
        "primary": "ds_4lhwtNWq"
    },
    "eventHandlers": [
        {
            "type": "drilldown.setToken",
            "options": {
                "tokens": [
                    {
                        "key": "row.UF.value",
                        "token": "clicked_uf"
                    }
                ]
            }
        }
    ],
    "options": {
        "backgroundColor": "#294e70",
        "center": [
            -13.79021870397439,
            -52.07072204233867
        ],
        "layers": [
            {
                "additionalTooltipFields": [
                    "Quantidade de erros"
                ],
                "areaIds": "> primary | seriesByName('UF')",
                "areaValues": "> primary | seriesByName('Quantidade de erros')",
                "bubbleSize": "> primary | frameBySeriesNames('Quantidade de erros')",
                "choroplethOpacity": 0.5,
                "choroplethStrokeColor": "transparent",
                "latitude": "> primary | seriesByName('LATITUDE')",
                "longitude": "> primary | seriesByName('LONGITUDE')",
                "resultLimit": 50000,
                "type": "choropleth"
            }
        ],
        "scaleUnit": "imperial",
        "zoom": 5.38493379665208
    },
    "title": "mapa",
    "type": "splunk.map",
    "context": {},
    "containerOptions": {},
    "showProgressBar": false,
    "showLastUpdated": false
}

below is the SPL query of the table:

index=<index> coderropc="0332"
| eval PC = replace(codpcredeprop, "^0+", "")
| stats count as "Erros por PC" by PC
| join type=left PC [| inputlookup PcFabricante.csv | eval CODPC=replace(CODPC, "^0+", "") | rename CODPC as PC | fields PC NOMEFABR MODELO]
| join type=left PC [| search index=ars source=GO earliest=-30d@d latest=now | eval CODPC=replace(CODPC, "^0+", "") | rename CODPC as PC | fields PC UF]
| search UF="$token_mapa$"
| table PC, NOMEFABR, MODELO, UF, "Erros por PC"

Is there any configuration that is different between Splunk classic and Splunk Dashboard Studio? When I add the default value in the map, the table receives the value, but does not register the clicks.

[livehybrid]

Hi @arlissilva 

It looks like your table SPL uses "token_mapa" but the token you are setting is "clicked_uf". If you update these do you get the same issue?

Assuming that UF is a valid field in the map results then the clicked_uf value should be updated, do you see this update in your browser URL?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[arlissilva]

Hi @livehybrid , thank you very much for the reply, I corrected the 'clicked_uf' in my SPL table, it was my oversight, but the problem persists. Regarding my URL not updating with the clicked_uf, it doesn't even appear in the MAPA URL, it seems that it doesn't recognize the click.