Dashboards & Visualizations

Under Drilldown Custom search, eval is not working.

gpayal18
Explorer

In my drilldown editor for Pie Chart, I am using Custom search string . Inside that I'm using eval expression and saving the query.
This is the search query:
"$BuildTok1$"="" "" "$Category_token$"| convert auto("$BuildTok1$") as Actualtime |
convert auto(Requirement) as ExpectedTime | eval TestStatus=case(Actualtime==0, "NotExecuted", Actualtime <= ExpectedTime ,"Pass", Actualtime > ExpectedTime, "Fail") |sort TestStatus | table CTQID,CTQDescription, TestStatus, Requirement, Actualtime

After clicking on pie chart, it is redirecting me to blank URL.
If i use the same search query in search, it works and gives me results.

When I removed eval statement and fired query without that. pie chart click worked.
this was the query without eval:
"$BuildTok1$"="" "" "$Category_token$"| convert auto("$BuildTok1$") as Actualtime |
convert auto(Requirement) as ExpectedTime table CTQID,CTQDescription, Requirement, Actualtime

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gpayal18

Have you tried with this eval in custom drilldown search?

| eval TestStatus=case(Actualtime==0, "NotExecuted", Actualtime &lt;= ExpectedTime ,"Pass", Actualtime &gt; ExpectedTime, "Fail")
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...