Filtering results in an inline drilldown to exclude unrelated events.

[RVDowning]

<form>
  <label>Analytics</label>
  <description/>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" searchWhenChanged="true"/>
  </fieldset>

  <row>
    <panel>
      <chart>
        <title>Datasets Created by Type</title>
        <searchString>host=MA*  Grp=RequestDataset
          | eval RequestType=if(Lvl="DepartmentGroup","Divn",if(IDL="Class","Dept-Cls",if(IDL="Vendor","Dept-Vend","Dept")))
          | chart dc(TId) by RequestType</searchString>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.style">shiny</option>
        <drilldown>
          <set token="type_tok">$click.value$</set>
        </drilldown>
      </chart>
      <table depends="$type_tok$">
        <title>Chart for $type_tok$</title>
        <searchString>host=MA*  Grp=RequestDataset
          | sort _time
          | eval RequestType=if(Lvl="DepartmentGroup","Divn",if(IDL="Class","Dept-Cls",if(IDL="Vendor","Dept-Vend","Dept")))
          | where $type_tok$ = RequestType          
          | eval RequestDate = strftime(_time, "%m-%d")
          | fields _time, $type_tok$, RequestType, Lvl 
        </searchString>
      </table>
    </panel>
  </row>
</form>

I have a pie chart and an inline drilldown. The clicked on value does get passed to the inline search, but how do I filter the results so that only the events corresponding to the clicked on value get displayed?

For example, the user may click on the "Divn" section of the pie chart, and "Divn" gets passed to the inline search. If RequestType = "Divn" then I want the event to display, otherwise not.

It seems I'm not using the Where clause correctly, but I'm not quite sure how to set it up.

[somesoni2 · Accepted solution]

Try this for the drilldown search (2nd search)

host=MA* Grp=RequestDataset [|gentimes start=-1 
   | eval search=case("$type_tok$"="Divn", "Lvl=\"DepartmentGroup\"", 
   "$type_tok$"="Dept-Cls", "IDL=\"Class\"", 
   "$type_tok$"="Dept-Vend", "IDL=\"Vendor\"", "$type_tok$"="Dept", "*") | table search ]
   | eval RequestDate = strftime(_time, "%m-%d") | eval RequestType="$type_tok$"
  | fields _time, $type_tok$, RequestType, Lvl 

[somesoni2]

"|gentimes start=-1 " is just generate single dummy row without accessing any index.

[RVDowning]

Yep, that did it, thanks. Though I don't understand the start=-1 which should just mean one day ago.

[RVDowning]

Sorry, it did not retain the formatting so it appears jumbled.