Splunk Search

How to fix token with a field created using "eval"?

Goldenfit
Explorer

so I created a field like so: 

|eval message_id=AREA.SUBID
| stats count as "Number of message_id" by message_id
| sort 10 - "Number of message_id"

This gives me a column chart with the message_id on the X axis and count on Y axis. With the drilldown setting shown in the pictures below, i'm trying  to make that the following query  indicate details only for the specific message_id I am cliking on the column chart

 |eval message_id=AREA.SUBID
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|where message_id="$mess_id2$"
|sort - count

Goldenfit_0-1685458818139.png

Yet I get the "no results found" message. I know this is related to the fact that the field is "artificial" but I can't find a way to fix it

Labels (2)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You might want to try $click.name$ rather than $click.value$ in your drilldown token

Also, you might want to filter the search results earlier:

| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The where command returns no results because there is no message_id field in the data.  The field was stripped out by the stats command.  Perhaps moving where before stats will give you the results you seek.

---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

You might want to try $click.name$ rather than $click.value$ in your drilldown token

Also, you might want to filter the search results earlier:

| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...