Hello, I have this code for a clickable chart to show details about the bar graph printed bellow: index="" host= sourcetype=csv source=C:\\....\\* | dedup source iswID iswCQR iswCC | table iswID...
See more...
Hello, I have this code for a clickable chart to show details about the bar graph printed bellow: index="" host= sourcetype=csv source=C:\\....\\* | dedup source iswID iswCQR iswCC | table iswID iswTitle iswCQR iswCCsource | where iswCQR !="" | eval YYYY_CW_DD=split(source,"\\") | eval YYYY_CW_DD=substr(mvindex(YYYY_CW_DD, mvcount(YYYY_CW_DD)-1),1,11) | eval test1=if((iswCC="New Requirement") and (iswCQR !="No" and iswCQR !="Quoted" and iswCQR !="Accepted"), 1,0) | stats sum(test1) as "New requirement without No, Quoted, Accepted" by YYYY_CW_DD | where YYYY_CW_DD="$date2$" | where "New requirement without No, Quoted, Accepted"="$yaxis2$" The drilldown token is set as $date2$ = $click.value$ and $yaxis2$=$click.name2$ The chart code is almost the same as this, besides the addition of the drilldown tokens The goal is to show in the details table all the ID's that are summed inside the bar graph, for instance, the 86 values in the bar (showed in the print bellow) should return the 86 IDs listed in the table. How can I do that?