I want to pass the Country name when I click on my map. Country is one of the fields in the data. Say if I click on Keyna, I want Kenya to be passed as a token on the next search.
Here is what I am doing -
I have an inputlookup file where I have the list of countries and the coordinates.
Then on my index, I have the list of few countries. Running a join on lookup file and the indexed data.
Here is my search:
|inputlookup Countries.csv | join type=inner [search index=crm] | geostats latfield=latitude longfield=longitude binspanlat=1 binspanlong=1 count
This gets me the Blue dots on the map based on the indexed data. However I am not able to run the count by command.
Also I would like if the Name of the country appears next to the dot on the map.
Later, I want to know how to pass a specific field's value when I click on the Country. I want to pass the country name to next search. I know how to pass a token, I need to know how to pass a value from a specific field.
SOS!!!
You need to code row.<YourFieldName>
not result.<YourFieldName>
Code the map's <drilldown>
event to capture field value of the clicked marker using row.<YourFieldName>
Refer to Splunk documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#map_.28event_t...
In thought it was something like $click.$ so in this case $click.Country$