How to return details from a results bar graph into a separate table?

[KalebeRS]

Hello, I have this code for a clickable chart to show details about the bar graph printed bellow:

index="" host= sourcetype=csv source=C:\\....\\*
| dedup source iswID iswCQR iswCC
| table iswID iswTitle iswCQR iswCCsource
| where iswCQR !=""
| eval YYYY_CW_DD=split(source,"\\")
| eval YYYY_CW_DD=substr(mvindex(YYYY_CW_DD, mvcount(YYYY_CW_DD)-1),1,11)
| eval test1=if((iswCC="New Requirement") and (iswCQR !="No" and iswCQR !="Quoted" and iswCQR !="Accepted"), 1,0)
| stats sum(test1) as "New requirement without No, Quoted, Accepted" by YYYY_CW_DD
| where YYYY_CW_DD="$date2$"
| where "New requirement without No, Quoted, Accepted"="$yaxis2$"

The drilldown token is set as $date2$ = $click.value$ and $yaxis2$=$click.name2$

The chart code is almost the same as this, besides the addition of the drilldown tokens

The goal is to show in the details table all the ID's that are summed inside the bar graph, for instance, the 86 values in the bar (showed in the print bellow)  should return the 86 IDs listed in the table.

How can I do that?

[ITWhisperer · Accepted solution]

Try something like this

index="" host= sourcetype=csv source=C:\\....\\*
| dedup source iswID iswCQR iswCC
| table iswID iswTitle iswCQR iswCCsource
| where iswCQR !=""
| eval YYYY_CW_DD=split(source,"\\")
| eval YYYY_CW_DD=substr(mvindex(YYYY_CW_DD, mvcount(YYYY_CW_DD)-1),1,11)
| where YYYY_CW_DD="$date2$"
| where (iswCC="New Requirement") and (iswCQR !="No" and iswCQR !="Quoted" and iswCQR !="Accepted")

[KalebeRS]

Do you have any tip for graphs that have two or more fields? Same case as my first question, but in this case now I have two fields.

index="" host= sourcetype=csv source=C:\\.....\\*
| dedup source LCS ID
| table ID Title source LCS SWVersion pverLCS
| where pverLCS!="Closed" and pverLCS!="Canceled"
| search pverSWVersion=$sw_version_filter$
| eval YYYY_CW_DD=split(source,"\\")
| eval YYYY_CW_DD=substr(mvindex(YYYY_CW_DD, mvcount(YYYY_CW_DD)-1),1,11)
| where YYYY_CW_DD="$date3$"
| eval test1=if(LCS!="Planned" and LCS!="Implemented" and LCS!="Qualified" and LCS!="Canceled",1,0)
| eval test2=if(LCS="Planned" or LCS="Implemented" or LCS="Qualified" or LCS="Canceled",1,0)
| fields - source LCS SWVersion pverLCS YYYY_CW_DD test1 test2

[ITWhisperer]

The search doesn't look quite right, your table commands defines the fields you want near the start, but the fields command removes most of them just leaving you with ID and Title; is that what you want in your table?

Assuming this is what you want, what search are you using for your chart?

[KalebeRS]

Almost the same besides the sum for the two evals for the results.

What I need in the details table is just the ID's and titles. Same as my original question, but with two fields now.

[ITWhisperer]

"Almost the same" does say what the two fields are called.

In the drilldown from the first chart, you could set a token "test_result", which is set to 1 if one column is selected ($click.name2$ == "New requirement without No, Quoted, Accepted") and 0 if the other column is selected.

<eval token="test_result">if($click.name2$ == "New requirement without No, Quoted, Accepted", 1, 0)</eval>

 Then change your search to check this new token

index="" host= sourcetype=csv source=C:\\.....\\*
| dedup source LCS ID
| table ID Title source LCS SWVersion pverLCS
| where pverLCS!="Closed" and pverLCS!="Canceled"
| search pverSWVersion=$sw_version_filter$
| eval YYYY_CW_DD=split(source,"\\")
| eval YYYY_CW_DD=substr(mvindex(YYYY_CW_DD, mvcount(YYYY_CW_DD)-1),1,11)
| where YYYY_CW_DD="$date3$"
| where (LCS!="Planned" and LCS!="Implemented" and LCS!="Qualified" and LCS!="Canceled" and $test_result$ == 1) OR $test_result$ != 1
| fields - source LCS SWVersion pverLCS YYYY_CW_DD test1 test2