Why is drilldown on dashboard not working properly?

[jhilton90]

I have a dashboard which displays information about password resets and I have a bar chart showing the top 20 accounts that have reset their passwords, code as follows:

index=keycloak "fields.environment"=production redirect_uri=* type=UPDATE_PASSWORD 
| rename customerReferenceAccountId as AccountID | top AccountID limit=20

This displays as a bar chat absolutely fine, however what I'm trying to achieve is to be able to click one of the bars in this chart, which will then display a table with AccountID, username, userId, redirect_uri, ipAddress, _time. Code as follows:

index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID$ type=UPDATE_PASSWORD 
| table $AccountID$, username, userId, redirect_uri, ipAddress, _time

In the first table I have set the "On Click" with a value of "Manage tokens on this dashboard" as follows: Set AccountID = $click.value$.

However, when I click on one of the bars, the table below isn't displaying any information, I just get "No results found" but I know that there are results

[woodcock]

Run the dashboard.
Click "Edit".
Scroll to your panel.
In the upper-right corner, click on the snowman menu and select "Edit Drilldown".
In the popup that opens, select "Link to Search".
In the redrawn popup, select, "Custom".
Paste this in it: index="keycloak" AND fields.environment="production" AND customerReferenceAccountId="$click.value$" AND type="UPDATE_PASSWORD" | table AccountID, username, userId, redirect_uri, ipAddress, _time
Or maybe something like this: |inputlookup foo WHERE AccountID="$click.value$"
Save it all.

[ITWhisperer]

index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID$ type=UPDATE_PASSWORD 
| table customerReferenceAccountId, username, userId, redirect_uri, ipAddress, _time

[jhilton90]

That doesn't work I'm afraid

[ITWhisperer · Accepted solution]

Try this

index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID|s$ type=UPDATE_PASSWORD 
| table customerReferenceAccountId, username, userId, redirect_uri, ipAddress, _time

[jhilton90]

Isn't that the same? I tried it but it didn't work

[ITWhisperer]

No, it uses |s to make the token a string - without more detail on what your events look like and what exactly isn't working, it is a little difficult to make other suggestions. If you want more help, please provide more detail on what your issues are

[jhilton90]

No it's okay you were right, I had a typo

Thanks!