Splunk Enterprise

How to set the Initial value of drilldown's token?

SCSC
Explorer

I made drilldown from pie chart to scatter chart.

Pie chart :

 

<drilldown>
 <set token="BU">$row.BU$</set>
</drilldown>

 

search sentence of Scatter chart : 

 

<search>
 <query>
  index="indexA"
  | search BU=$BU$ 
  | eval XXX
 </query>
 <earliest>$field1.earliest$</earliest>
 <latest>$field1.latest$</latest>
</search>

 


Question : Can I set the  Initial or default value of this token?
I'm in trouble that scatter chart does not appear until you click something on pie chart.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding a done handler to the search of the pie chart, and set the initial value of the token there.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding a done handler to the search of the pie chart, and set the initial value of the token there.

0 Karma

SCSC
Explorer

It was solved thanks to you.
Thank you very much !

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...