Splunk Enterprise

How to set the Initial value of drilldown's token?

SCSC
Explorer

I made drilldown from pie chart to scatter chart.

Pie chart :

 

<drilldown>
 <set token="BU">$row.BU$</set>
</drilldown>

 

search sentence of Scatter chart : 

 

<search>
 <query>
  index="indexA"
  | search BU=$BU$ 
  | eval XXX
 </query>
 <earliest>$field1.earliest$</earliest>
 <latest>$field1.latest$</latest>
</search>

 


Question : Can I set the  Initial or default value of this token?
I'm in trouble that scatter chart does not appear until you click something on pie chart.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding a done handler to the search of the pie chart, and set the initial value of the token there.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding a done handler to the search of the pie chart, and set the initial value of the token there.

0 Karma

SCSC
Explorer

It was solved thanks to you.
Thank you very much !

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...