Splunk Enterprise

How to set the Initial value of drilldown's token?

SCSC
Explorer

I made drilldown from pie chart to scatter chart.

Pie chart :

 

<drilldown>
 <set token="BU">$row.BU$</set>
</drilldown>

 

search sentence of Scatter chart : 

 

<search>
 <query>
  index="indexA"
  | search BU=$BU$ 
  | eval XXX
 </query>
 <earliest>$field1.earliest$</earliest>
 <latest>$field1.latest$</latest>
</search>

 


Question : Can I set the  Initial or default value of this token?
I'm in trouble that scatter chart does not appear until you click something on pie chart.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding a done handler to the search of the pie chart, and set the initial value of the token there.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding a done handler to the search of the pie chart, and set the initial value of the token there.

0 Karma

SCSC
Explorer

It was solved thanks to you.
Thank you very much !

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...