Hello @jrs42, In Dashboard studio, there's no option to specify a drilldown for a particular cell or a row. When you enable the drilldown, by default it gets applied to a cell. You can find the following JSON source code as an example for a drilldown to set token in dashboard studio. { "visualizations": { "viz_dNS83Gj5": { "type": "splunk.table", "dataSources": { "primary": "ds_aQ7285AG" }, "eventHandlers": [ { "type": "drilldown.setToken", "options": { "tokens": [ { "token": "log_level_tok", "key": "row.log_level.value" } ] } } ] }, "viz_qGr86Sbm": { "type": "splunk.events", "options": {}, "dataSources": { "primary": "ds_MmJUCreO" } } }, "dataSources": { "ds_aQ7285AG": { "type": "ds.search", "options": { "query": "index=_internal source=\"*splunkd.log\"\n| stats count by log_level", "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } }, "name": "Search_1" }, "ds_MmJUCreO": { "type": "ds.search", "options": { "query": "index=_internal source=\"*splunkd.log\" log_level=\"$log_level_tok$\"", "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } }, "name": "Search_2" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "viz_dNS83Gj5", "type": "block", "position": { "x": 0, "y": 0, "w": 300, "h": 300 } }, { "item": "viz_qGr86Sbm", "type": "block", "position": { "x": 300, "y": 0, "w": 1140, "h": 300 } } ], "globalInputs": [ "input_global_trp" ] }, "description": "", "title": "Test Input Placeholder" }   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!!   ... View more

Hello @JayD, As you already mentioned that the apps have been forgotten for over a year, it is likely that the latest details have not been updated on the instance. You can first ensure that you have upgraded the Upgrade Readiness App to the latest version and re-run the scan. If the above apps still fail, you can follow the following steps as a workaround: - Run the following script - /opt/splunk/etc/apps/python_upgrade_readiness_app/bin/pura_get_all_apps.py (Internet connection will be required). - Create a directory named app_list in the following path - /opt/splunk/etc/apps/python_upgrade_readiness_app/local/ - Place the attached splunkbaseapps.csv in the app_list folder. - Re-run the scan and check for the final report.   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated.   ... View more

Hello @Santosh2 , There's a bit of typo in the search command for using the selected site token. You've typed seach instead of search. Also, if you're using search command, you need to filter it on the basis of key value search. Host specific dropdown should look like this: | makeresults | eval site="BDC", host="jboss.cloud.com" | fields site host | append [| makeresults | eval site="BDC", host="ulkoy.cloud.com" | fields site host] | append [| makeresults | eval site="BDC", host="ualki.cloud.com" | fields site host] | append [| makeresults | eval site="BDC", host="hyjki.cloud.com" | fields site host] | append [| makeresults | eval site="SOC", host="uiy67.cloud.com" | fields site host] | append [| makeresults | eval site="SOC", host="7hy56.cloud.com" | fields site host] | append [| makeresults | eval site="SOC", host="ju5e.cloud.com" | fields site host] | append [| makeresults | eval site="SOC", host="mjut.cloud.com" | fields site host] | search site="$site$" | dedup host | sort host | table host   Thanks, Tejas.   --- If the above solution helps an upvote is appreciated. ... View more