Dashboards & Visualizations

Under Drilldown Custom search, eval is not working.

gpayal18
Explorer

In my drilldown editor for Pie Chart, I am using Custom search string . Inside that I'm using eval expression and saving the query.
This is the search query:
"$BuildTok1$"="" "" "$Category_token$"| convert auto("$BuildTok1$") as Actualtime |
convert auto(Requirement) as ExpectedTime | eval TestStatus=case(Actualtime==0, "NotExecuted", Actualtime <= ExpectedTime ,"Pass", Actualtime > ExpectedTime, "Fail") |sort TestStatus | table CTQID,CTQDescription, TestStatus, Requirement, Actualtime

After clicking on pie chart, it is redirecting me to blank URL.
If i use the same search query in search, it works and gives me results.

When I removed eval statement and fired query without that. pie chart click worked.
this was the query without eval:
"$BuildTok1$"="" "" "$Category_token$"| convert auto("$BuildTok1$") as Actualtime |
convert auto(Requirement) as ExpectedTime table CTQID,CTQDescription, Requirement, Actualtime

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gpayal18

Have you tried with this eval in custom drilldown search?

| eval TestStatus=case(Actualtime==0, "NotExecuted", Actualtime &lt;= ExpectedTime ,"Pass", Actualtime &gt; ExpectedTime, "Fail")
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...