$row.<fieldname>$ tokens don't seem to be working?

[vincentle1]

I have a dashboard panel with a table showing some events, which each contain a jobId field. I'm trying to use the drilldown to set a token on the dashboard to that jobId, let's call it CLICKED_ID.

Then I should be able to go into the edit drilldown menu, pick Set, put in CLICKED_ID for the token name, and $row.jobId$ for the value. So far so good...

The problem arises when I go to a different dashboard panel after clicking on some row in the first panel and try to use that $CLICKED_ID$ token in its search. Yes, the $CLICKED_ID$ token is successfully replaced... by the string "$row.jobId$", not by the actual value of jobId from that event!

Not even fields that I know should exist in the events work; setting $CLICKED_ID$ to $row.sourcetype$ or $row.hostname$ didn't get the values correctly, instead just getting literally "$row.sourcetype$" and so on.

For now I'm getting around this by having the jobId appear in the table of the first panel and using $click.value2$, which works fine. However, I would like the user to be able to click any cell on that row and still have the right values go to the second panel, as opposed to having to click specifically on the jobId column. This is also a problem if I want to stop displaying the jobId on the first panel, too, since the user won't be able to click on it to populate the second panel.

Am I doing something wrong here? Please let me know if I can include anything more that might help. Thanks!

[renjith_nair · Accepted solution]

Do you have the xml for the same ? It would be easy to identify the issue. In a normal scenario, below should work unless you have a special characters in the value. Please do lets know where do you see the problem

<dashboard>
  <label>DrillDown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_*|stats count by sourcetype,index</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="CLICKED_ID">$row.sourcetype$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Events for sourcetype $CLICKED_ID$</title>
      <event>
        <search>
          <query>index=_* sourcetype=$CLICKED_ID$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</dashboard>

[vincentle1]

Hi @renjith_nair ,

I think I realized my mistake: I wasn't including the jobId field in the table of the first panel. I did not realize that it had to be part of the table to be eligible for $row.<fieldname>$ to be set; I wasn't including hostname either so of course that field also did not work!

After I added that field in the table (changed query from "| table _time, jobName, etc" to "| table _time, jobName, etc, jobId") and excluded it from the display using the instructions from this answer, it is working fine now.

Thank you very much for the response. It looks like I was indeed doing something wrong; I'll leave my error here in case anyone else runs into the same problem.