Dashboards & Visualizations

Under Drilldown Custom search, eval is not working.

gpayal18
Explorer

In my drilldown editor for Pie Chart, I am using Custom search string . Inside that I'm using eval expression and saving the query.
This is the search query:
"$BuildTok1$"="" "" "$Category_token$"| convert auto("$BuildTok1$") as Actualtime |
convert auto(Requirement) as ExpectedTime | eval TestStatus=case(Actualtime==0, "NotExecuted", Actualtime <= ExpectedTime ,"Pass", Actualtime > ExpectedTime, "Fail") |sort TestStatus | table CTQID,CTQDescription, TestStatus, Requirement, Actualtime

After clicking on pie chart, it is redirecting me to blank URL.
If i use the same search query in search, it works and gives me results.

When I removed eval statement and fired query without that. pie chart click worked.
this was the query without eval:
"$BuildTok1$"="" "" "$Category_token$"| convert auto("$BuildTok1$") as Actualtime |
convert auto(Requirement) as ExpectedTime table CTQID,CTQDescription, Requirement, Actualtime

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gpayal18

Have you tried with this eval in custom drilldown search?

| eval TestStatus=case(Actualtime==0, "NotExecuted", Actualtime &lt;= ExpectedTime ,"Pass", Actualtime &gt; ExpectedTime, "Fail")
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!