I have a Dashboard with a graph and a drilldown table underneath it. The graph shows on the x-axis an eval field (concat of two strings), and I need those two strings on the drilldown table. However, if I hide those fields from the graph they don't get filled in the drilldown tokens, and if they're displayed, they make no sense on the graph.
I think it could also work, although it's a bit ugly. I could split the concatenated value into two tokens to be used in the drilldown search query, but I can't find how to do it.
Sample code:
<chart>
<search>
<query>
source="query.log" ac=main
| stats AVG(time) as time, p95(time) as perc by controller, action
| eval form=controller."/".action
| sort -perc
| fields form, time, perc, controller, action <!-- wanted to hide controller and action from graph -->
</query>
</search>
<drilldown>
<set token="main_form">$row.form$</set>
<set token="main_controller">$row.controller$</set><!-- isn't filled if hidden at "fields" -->
<set token="main_action">$row.action</set><!-- isn't filled if hidden at "fields" -->
</drilldown>
</chart>
Current result (with renamed fields and whatnot); ac/controller and af/action shouldn't be on the graph, but present on query so they can be used on drilldown:
... View more
