Splunk Search

Splunk and Drilling down into Charts

damogallagher
New Member

Hi

I am using a Pie chart and I want to be able to drill down into see the results, but when I try this, I get the following error message
PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'replace' command

Here is the search I am using
host=MTSFARM-13U-PTCSWSEIU1 Status="PreInboundProcessorSelector" | top ProcessorLookup limit="25"
| replace "DELIVERY_REPORT_1_PROCESSOR" with "Delivery Report 1" in ProcessorLookup
| replace "REJECTED_DELIVERY_REPORT_2_PROCESSOR" with "Rejected Delivery Report 2" in ProcessorLookup

I need to use the replace command so that the pie chart can have meaningful values in the Legend.
Is there anyway to have meaningful values on my chart and still be able to drill down into the chart?

Tags (1)
0 Karma

BobM
Builder

Some commands that change the data including replace do not map well to automated drilldown. In those cases, you will need to use advanced XML and specify the drildown search.

A good explanation of this is given here

[http://www.splunk.com/base/Documentation/latest/Developer/TableChartDrilldown]http://www.splunk.com/...]

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...