I'm sorry if I'm causing confusion. And not sure if you would call this drilldown. My requirement: I have two input fields(type - radio buttons). And depending on what value the user selects I want the filters to apply on two of the fields in the table namely node & outcome. For which I've written these statements in the table query: | search node="$form.tokenNode$" outcome="$form.tokenSwitch$" Node(radio button has below options): ABC DEF XYZ Outcome(radio button has below options): True False Both If I use one radio button(lets say just node) field it works, however when I add the second one it doesn't work. Means when im selecting node values from the radio button, the table is reloading & filtering the data based on the node value selected. I want the same to work for the second radio button as well. here is how these input (radio buttons look like): <input type="radio" token="tokenNode" searchWhenChanged="true"> <label>Node</label> <choice value="ABC">ABC</choice> <choice value="DEF">DEF</choice> <choice value="XYZ">XYZ</choice> <default>ABC</default> <initialValue>ABC</initialValue> </input> <input type="radio" token="tokenSwitch" searchWhenChanged="true"> <label>Outcome</label> <choice value="True">True</choice> <choice value="False">False</choice> <choice value="Both">Both</choice> <default>True</default> <initialValue>True</initialValue> </input> Hope I'm able to explain it. ... View more

I have a table which is getting data from one of our indexes, somewhat like below: <table> <title>Tech Spec Values for Selected Node:</title> <search> <query>index=test_index_prod sourcetype="SPEC" | eventstats max(rundate) as maxDate, max(runtime) as maxTime, count as fno | where rundate=maxDate AND runtime=maxTime | search node="$form.tokenNode$" outcome="$form.tokenSwitch" | table node, outcome, name, class, resource | sort node, name</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <set token="tokenNode">$click.value$</set> <set token="tokenSwitch">$click.value$</set> </drilldown> </table>   And then I have two radio button fields with token names as tokenNode & tokenSwitch with both having different values. I want the drilldown to happen when any of the radio button value is selected by user from the two radio button input fields. ... View more

Yeah, that is an option as well. However, thought it would be easier if there was an option to rename the fields while writing to the lookup table. I did an AI search which showed outputlookup had a rename option, but couldn't find it in the syntax on splunk website. So was just curious as well, if it is possible at all. ... View more

Understood. I will find a way to handle that, as my search does not return result everytime.   Thank you for your patience & help. ... View more

If you meant that if I run below only: | loadjob savedsearch="myuserid:my_app:my_saved_search" It runs & returns 0 events as last run of the search did not return any result. ... View more

Thank you for your response. I added $ sign in the return field ($actor), however I am still getting the below error.   Error in 'EvalCommand': Failed to parse the provided arguments. Usage: eval dest_key = expression. ... View more

Apologies I am new to SPL. My requirement is to get values of a previously run saved search in a new field in current search. And I have only changed the names in my original search, it is what I was trying to use:   index=my_pers_index sourcetype=ACCT | eval userid = [| loadjob savedsearch="myuserid:my_app:my_saved_search" | return actor] I was getting Error in 'EvalCommand': Failed to parse the provided arguments. Usage: eval dest_key = expression. Which possibly means, the block of commands in [] is not returning a value as expected by eval. Any help on how I can get all the field values into a field in my current search would be appreciate. ... View more