Dashboards & Visualizations

Under Drilldown Custom search, eval is not working.

gpayal18
Explorer

In my drilldown editor for Pie Chart, I am using Custom search string . Inside that I'm using eval expression and saving the query.
This is the search query:
"$BuildTok1$"="" "" "$Category_token$"| convert auto("$BuildTok1$") as Actualtime |
convert auto(Requirement) as ExpectedTime | eval TestStatus=case(Actualtime==0, "NotExecuted", Actualtime <= ExpectedTime ,"Pass", Actualtime > ExpectedTime, "Fail") |sort TestStatus | table CTQID,CTQDescription, TestStatus, Requirement, Actualtime

After clicking on pie chart, it is redirecting me to blank URL.
If i use the same search query in search, it works and gives me results.

When I removed eval statement and fired query without that. pie chart click worked.
this was the query without eval:
"$BuildTok1$"="" "" "$Category_token$"| convert auto("$BuildTok1$") as Actualtime |
convert auto(Requirement) as ExpectedTime table CTQID,CTQDescription, Requirement, Actualtime

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gpayal18

Have you tried with this eval in custom drilldown search?

| eval TestStatus=case(Actualtime==0, "NotExecuted", Actualtime &lt;= ExpectedTime ,"Pass", Actualtime &gt; ExpectedTime, "Fail")
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...