I want to show the Drill Down View. When I click on Parent graph, compound string is passed as Parameter to ConvertToIntention. I want to split the clicked value in underlying query. The query is as follows.
index="tougou" sourcetype="network"
| fields host,network_interface_name, bytes_sent_per_second, Bytes_Received_Per_Second
| eval host_split=(split($host_if$,":"))
| eval host_new=(mvindex(host_split,0))
| search host=host_new
| timechart max(bytes_sent_per_second), max(Bytes_Received_Per_Second) by host limit=50 useother=f
But when I use $host_if$ which is my parameter from ConvertToIntention, in the eval function it gives following error
PARSER: Applying intentions failed Error in 'eval' command: The expression is malformed. Expected ).
How Can I use the value from ConvertToIntention in eval function, as I have to split that value and get the required parameter for my Dril down view??
Thanks In Advance!
... View more