I have a series of panels in a dashboard that drill down to the next panel. I discovered that the data I want to drilldown on the populates in different sections of the event. I used the field extraction tool in splunk to create two fields. I then used the eval and coalesce to create one field. index=”someIndex” sourcetype="FooSource" | rename Field1 as Foo1 Field2 as Foo2 | eval TotalFoo = coalesce(foo1,foo2) | chart dc(field3) by "TotalFoo" Field4 For the panel I want to populate based on the TotalFoo field won't work. I believe this is due to the sub-search runs before the main search, so the TotalFoo field does not exist. index=”someIndex” sourcetype="FooSource" | rename Field1 as Foo1 Field2 as Foo2 | eval TotalFoo = coalesce(foo1,foo2) | search TotalFoo="$onClick$" I'm wondering how to get around this limitation or if that is possibel?
... View more