token passage

[sahana]

Hi ,

I have requirement like there two panels, in which the 1st one has success and failure as a column name and on click of these success or failure count a drill down panel should show the result.

these success and failure was categorized by below values in logs like

statusCode = 200 , then its is success

statusCode = 400 or 500, then it is failure

as said above the drilldown panel should show result on selection of the success/ failure count.

it tried with below query it is not working 

having token as $col$ which gets selection of that column name(Success/Failure)

query is

message.flow="individual" | eval status=$col$| eval source= case(status=="Success",200,status=="Failure",400 OR 500) | message. statusCode= source| table time,details, message. statusCode

kindly help on fixing it. the parameter value of source should be passed to the message.statusCode

[gcusello]

Hi @sahana,

at first I see that there's an error (probably for cut & past) of missing eval before message.StatusCode,

Then I hint to avoid dot "." in field names, use always underscore "_", if there's a dot rename it.

The main question is: what do you pass on click: "click.value" or "click.name"?

You should pass the "click.name" value to have "Success" or "Failure"; beware to the upper or lower case that must be the same!

In few words, passing on click the "click.name" value as token  I'd use a different approach:

your_search 
| rename message.flow AS message_flow
| eval message_flow="individual" 
| eval status=$col$
| eval statusCode=case(status="Success",200,status="Failure","400 or 500") 
| table time details statusCode

Ciao.

Giuseppe