The search behind my chart:
index="myindex" | ... | timechart count by AnimalTypes (the problem is that AnimalTypes sometimes doesn't exist)
My dashboard displays the following Legend:
- cats
- dogs
- NULL (because sometimes AnimalTypes doesn't exist)
Drilldown search:
index="myindex" | ... | search AnimalTypes=$click.name2$
If I click my dashboard for cats or dogs, it works fine , but when I click the NULL barchart, my clickdown search becomes:
index="myindex" | .. | search AnimalTypes=NULL
(doesn't work)
But it want the search to look like this (which works):
index="myindex" | ... | where isnull(AnimalTypes)
How do I do this? 🙂
In your drilldown, you should evaluate a token dependent on the value of $click.name2$ and use the new token in the search
<eval token="AnimalTypesSearch">if("$click.name2$"="NULL","isnull(AnimalTypes)","AnimalTypes=$click.name2|s$")</eval>
index="myindex" | ... | where $AnimalTypesSearch$
Also note the switch to using where rather than search so that isnull function becomes valid
I have a very similar thing going on, I can get the eval in the drilldown to work when I have a static value, however, it does not like when I have a variable in the 'false'
in this example it would be the
"AnimalTypes=$click.name2|s$"
part. It is not substituting $click.value$ in my case (you have $click.name2|s$) with the value, it is sending the $click. Value$ parameter to the search..
thoughts?
To help others, I figured it out, the false result to have text and a token looks like:
"AnimalTypes=".$click.value$
Notice the "s around the text and the . (dot) between the token.
Hi,
Thanks, but where do I put the:
"<eval token="AnimalTypesSearch">....."
In the drilldown of the panel which you are clicking on.
Give this a try:
Drilldown search:
index="myindex" | ... | where AnimalTypes=if("$click.name2$"="NULL","","$click.name2$")
Then I get (when I click on the "NULL" legend in the chart):
index="myindex" | ... | where AnimalTypes=if("NULL"="NULL","","NULL")