I'm trying to implement a drill down function from a cluster map to two other dashboards depending on which cluster (dot) you click. Refer the search String below:
(index=1 source="xxx_sensordata") OR (index=2 sourcetype=xxx_ACC) | dedup device | eval dashboard = case(device LIKE 2.0%","xxx_sensors", device LIKE "A81%","xxx_centre")| geostats count by dashboard
I've filtered the data as above so that the value assigned to the dashboard filed is the exact name of the dashboard.
Then i use the following XML for drill down:
<condition series="xxx_centre">
<link>$click.name2$</link>
</condition>
<condition series="xxx_sensors">
<link>xxx_sensors</link>
</condition>
</drilldown>
I've tried
condition series: http://docs.splunk.com/Documentation/Splunk/6.5.7/Viz/Understandbasictableandchartdrilldownactions#Contextual_drilldown_elements
conditional match : http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens#Define_conditional_matching
But the problem is that in map visualizations, $click.name2$ = $click.name$
Reference: docs.splunk.com/Documentation/Splunk/6.5.7/Viz/Understandbasictableandchartdrilldownactions#Contextual_drilldown_elements
Is there a work around for this?
... View more