Splunk Search

How to fix token with a field created using "eval"?

Goldenfit
Explorer

so I created a field like so: 

|eval message_id=AREA.SUBID
| stats count as "Number of message_id" by message_id
| sort 10 - "Number of message_id"

This gives me a column chart with the message_id on the X axis and count on Y axis. With the drilldown setting shown in the pictures below, i'm trying  to make that the following query  indicate details only for the specific message_id I am cliking on the column chart

 |eval message_id=AREA.SUBID
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|where message_id="$mess_id2$"
|sort - count

Goldenfit_0-1685458818139.png

Yet I get the "no results found" message. I know this is related to the fact that the field is "artificial" but I can't find a way to fix it

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You might want to try $click.name$ rather than $click.value$ in your drilldown token

Also, you might want to filter the search results earlier:

| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The where command returns no results because there is no message_id field in the data.  The field was stripped out by the stats command.  Perhaps moving where before stats will give you the results you seek.

---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

You might want to try $click.name$ rather than $click.value$ in your drilldown token

Also, you might want to filter the search results earlier:

| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...