Why custom drilldown XML in pie chart doesn't populate target field?

[ppurokit]

Hi All,

I have a pie chart where instead of using the default drilldown, i have a customized drilldown which i have added as part of the XML.

<dashboard>    <label>Daily XXXXX Reports</label>   <row>
    <chart>
      <searchName>Daily XXXXXX graph</searchName>
      <title>Top XXXXX - Last 24 hrs</title>
      <option name="charting.chart">pie</option>
      <option name="count">50</option>
      <option name="displayRowNumbers">true</option>
           <drilldown>
        <link>
            /app/XXX-ASA/flashtimeline?q=`cisco_asa` earliest=-24h@h latest=now |search src_ip="$row.Source Address$"
        </link>
      </drilldown>
    </chart>  </dashboard>

So from the Pie Chart when i click on the drilldown , the Source Address field never gets populated.

The same drilldown works fine for me on a "Table" Visualization.

Let me know on what needs to be changed for the value to get substituted.

[martin_mueller]

This works for me:

<dashboard>
 <row>
  <chart>
   <searchString>index=_internal | stats sum(bytes) as "Total Bytes" by sourcetype | rename sourcetype as "Source Address" | sort - "Total Bytes"</searchString>
   <earliestTime>-15m</earliestTime>
   <latestTime>now</latestTime>
   <option name="charting.chart">pie</option>
   <drilldown>
    <link>search?q=index=_internal sourcetype="$row.Source Address$"</link>
   </drilldown>
  </chart>
 </row>
</dashboard>

The drilldown looks like this:

index=_internal sourcetype="splunkd_access"

[theouhuios · Accepted solution]

Instead of $row.Source Address$ can you try with $click.value$

[ppurokit]

Thanks for the suggestion theouhuios.

Instead of $row.Source Address$ tried $click.value$

It worked out Well.

Thanks

[ppurokit]

Hi Martin,

My Actual Search query is

index=summary sourcetype=stash search_name="summary - Bandwidth Reports" | stats sum(mbytes) as "Total MBytes" by src_ip | rename src_ip as "Source Address" | sort -"Total MBytes" | head 15

[martin_mueller]

What columns do you have in the underlying table?

Also, do remove that |search part to have the src_ip filter be a part of the main search.