Splunk Search

How to fix token with a field created using "eval"?

Goldenfit
Explorer

so I created a field like so: 

|eval message_id=AREA.SUBID
| stats count as "Number of message_id" by message_id
| sort 10 - "Number of message_id"

This gives me a column chart with the message_id on the X axis and count on Y axis. With the drilldown setting shown in the pictures below, i'm trying  to make that the following query  indicate details only for the specific message_id I am cliking on the column chart

 |eval message_id=AREA.SUBID
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|where message_id="$mess_id2$"
|sort - count

Goldenfit_0-1685458818139.png

Yet I get the "no results found" message. I know this is related to the fact that the field is "artificial" but I can't find a way to fix it

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You might want to try $click.name$ rather than $click.value$ in your drilldown token

Also, you might want to filter the search results earlier:

| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The where command returns no results because there is no message_id field in the data.  The field was stripped out by the stats command.  Perhaps moving where before stats will give you the results you seek.

---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

You might want to try $click.name$ rather than $click.value$ in your drilldown token

Also, you might want to filter the search results earlier:

| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...