Splunk Search

How to fix token with a field created using "eval"?

Goldenfit
Explorer

so I created a field like so: 

|eval message_id=AREA.SUBID
| stats count as "Number of message_id" by message_id
| sort 10 - "Number of message_id"

This gives me a column chart with the message_id on the X axis and count on Y axis. With the drilldown setting shown in the pictures below, i'm trying  to make that the following query  indicate details only for the specific message_id I am cliking on the column chart

 |eval message_id=AREA.SUBID
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|where message_id="$mess_id2$"
|sort - count

Goldenfit_0-1685458818139.png

Yet I get the "no results found" message. I know this is related to the fact that the field is "artificial" but I can't find a way to fix it

Labels (2)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You might want to try $click.name$ rather than $click.value$ in your drilldown token

Also, you might want to filter the search results earlier:

| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The where command returns no results because there is no message_id field in the data.  The field was stripped out by the stats command.  Perhaps moving where before stats will give you the results you seek.

---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

You might want to try $click.name$ rather than $click.value$ in your drilldown token

Also, you might want to filter the search results earlier:

| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...