The token value I am trying to carry over in my table is the(token=$click.value$) using the field extracted In the drilldown editor. I have my values/parameters set to:
on click set "token"= $cli...
See more...
The token value I am trying to carry over in my table is the(token=$click.value$) using the field extracted In the drilldown editor. I have my values/parameters set to:
on click set "token"= $click.value$. I named my token name "Token" in the drilldown editor for simplicity.
In initial post I stated ***User Pie Chart with the drilldown token: token_user=$click.value$ *** but should by ***User Pie Chart with the drilldown token: "token"=$click.value$ ***
*** File Extension Pie Chart with the drilldown token: "token"=$click.value$ ***
index="user_files"
| rex field="document" "\.(?<extension>[^\.]*$$)"
| stats count(extension) by extension
However, when I call on the token "source = $token$" after declaring the index to display records based on pie chart selection, there is no search results.
*** Records by file type selected in Pie Chart: No Records found with selection from Pie Chart **
index="user_files" source=$*token$
| table _time, user_name, computer_name, source_directory, document
Apologize for the confusion. Hope that clears it up a little.