- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a dashboard which displays information about password resets and I have a bar chart showing the top 20 accounts that have reset their passwords, code as follows:
index=keycloak "fields.environment"=production redirect_uri=* type=UPDATE_PASSWORD
| rename customerReferenceAccountId as AccountID | top AccountID limit=20
This displays as a bar chat absolutely fine, however what I'm trying to achieve is to be able to click one of the bars in this chart, which will then display a table with AccountID, username, userId, redirect_uri, ipAddress, _time. Code as follows:
index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID$ type=UPDATE_PASSWORD
| table $AccountID$, username, userId, redirect_uri, ipAddress, _time
In the first table I have set the "On Click" with a value of "Manage tokens on this dashboard" as follows: Set AccountID = $click.value$.
However, when I click on one of the bars, the table below isn't displaying any information, I just get "No results found" but I know that there are results
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try this
index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID|s$ type=UPDATE_PASSWORD
| table customerReferenceAccountId, username, userId, redirect_uri, ipAddress, _time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Run the dashboard.
Click "Edit".
Scroll to your panel.
In the upper-right corner, click on the snowman menu and select "Edit Drilldown".
In the popup that opens, select "Link to Search".
In the redrawn popup, select, "Custom".
Paste this in it: index="keycloak" AND fields.environment="production" AND customerReferenceAccountId="$click.value$" AND type="UPDATE_PASSWORD" | table AccountID, username, userId, redirect_uri, ipAddress, _time
Or maybe something like this: |inputlookup foo WHERE AccountID="$click.value$"
Save it all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID$ type=UPDATE_PASSWORD
| table customerReferenceAccountId, username, userId, redirect_uri, ipAddress, _time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That doesn't work I'm afraid
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try this
index=keycloak "fields.environment"=production customerReferenceAccountId=$AccountID|s$ type=UPDATE_PASSWORD
| table customerReferenceAccountId, username, userId, redirect_uri, ipAddress, _time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Isn't that the same? I tried it but it didn't work
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

No, it uses |s to make the token a string - without more detail on what your events look like and what exactly isn't working, it is a little difficult to make other suggestions. If you want more help, please provide more detail on what your issues are
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No it's okay you were right, I had a typo
Thanks!
