Splunk Enterprise

How to set the Initial value of drilldown's token?

SCSC
Explorer

I made drilldown from pie chart to scatter chart.

Pie chart :

 

<drilldown>
 <set token="BU">$row.BU$</set>
</drilldown>

 

search sentence of Scatter chart : 

 

<search>
 <query>
  index="indexA"
  | search BU=$BU$ 
  | eval XXX
 </query>
 <earliest>$field1.earliest$</earliest>
 <latest>$field1.latest$</latest>
</search>

 


Question : Can I set the  Initial or default value of this token?
I'm in trouble that scatter chart does not appear until you click something on pie chart.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding a done handler to the search of the pie chart, and set the initial value of the token there.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding a done handler to the search of the pie chart, and set the initial value of the token there.

0 Karma

SCSC
Explorer

It was solved thanks to you.
Thank you very much !

0 Karma
Get Updates on the Splunk Community!

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...