Have this query I am using for a visualization:  <My query strings> | eval ApiName=upper(ApiName) | stats earliest(_time) AS StartTime latest(_time) AS EndTime BY correlationId ApiName | eval DurationInSecs = EndTime - StartTime | where DurationInSecs >= 0 | eval StartTimeR = StartTime + 30 | bin StartTimeR span=1m | eval Time = StartTimeR - 30 | eval _time = Time | timechart span=15m limit=0 useother=f $DurationToken$(DurationInSecs) BY ApiName I've added an interaction so that when someone clicks on a line or on the legend, it will open a new tab to the desired dashboard (works) and pass the token in to be used in a new query in a new visual in the newly opened dashboard (not working) Here is the interaction source code: {... "eventHandlers": [ { "type": "drilldown.linkToDashboard", "options": { "app": "mygroupname_search", "dashboard": "my_api_stats__api_drill_down", "newTab": true, "tokens": [ { "token": "ApiNameToken", "value": "row.ApiName.value" } ] } } ], ...}   However, when I click on the line/legend name for a specific ApiName I get the new dashboard tab opened, but the sent value is the text string 'row.ApiName.value' vs. the ApiName I clicked on/am expecting. I check to see what the token is carrying via a markdown text box I have on the new dashboard using $ApiNameToken$ in the text box.  I have zero issues with doing it this way when using anything other than a time chart. Please help me understand what am I doing incorrectly? ... View more

I have the below query I've written - I am used to SQL, SPL is still new to me. I feel like there has to be some way to make this shorter/more efficient - i.e:  Data: API_RESOURCE="/v63.0/gobbledygook/unrequitededits_somename_request" API_RESOURCE="/v62.0/gobbledygook/unrequitededits_somename_response" API_RESOURCE="/v61.0/gobbledygook/unrequitededits_somename_update" API_RESOURCE="/v63.0/gobbledygook/unrequitededits_somename_delete" API_RESOURCE="/v61.0/gobbledygook/unrequitededits_somename_delete" API_RESOURCE="/v62.0/gobbledygook/unrequitededits_somename_update" API_RESOURCE="/v61.0/gobbledygook/URI_PATH_batch_updates" Original query: index="some_index" API_RESOURCE!="" | eval API_RESOURCE=case( LIKE(API_RESOURCE,"%63%"),"/v63", LIKE(API_RESOURCE,"%62%"),"/v62", LIKE(API_RESOURCE,"%61%"),"/v61",1==1, API_RESOURCE) |stats count by API_RESOURCE Desired query: index="some_index" API_RESOURCE!="" | eval API_RESOURCE=case(LIKE(API_RESOURCE,"%6\d%"),"/v6\d",1==1, API_RESOURCE) |stats count by API_RESOURCE Where the outcome would be the three versions being counted as grouped within their own version (so, v/63 = 2, v/62 = 2, v/61= 2 Every time I run the 'desired query' it completely ignores the wildcard/variable in both the search and replace part of the case statement. Any help would be appreciated, as there are at least 64 current versions, and every time a new one is developed it gets the next highest version number Thanks in advance! ... View more