@alonsocaiodo you know if you have to take the splunk courses in-order to take the certification exams? Can I learn the material in other ways and then sign up for the Certification exam all the same? ... View more

@FrankVl  I found the Answer in this post I see your original point was correct i had it wrong ... View more

@FrankVl So this Semi worked as when I played around with it I did get it to work however i believe the <fields> tag does refresh as much as the table does so when I took out some values and added others in the table would keep what the fields tag had in it originally. I had to refresh the page for it to add the next multi-select input. Is there a way I can force a refresh? ... View more

Hi @FrankVl  Let me share with you the full query with the links  this is it with attempting to use the <fields> tag  The Drill-down part works however when I try to add fields into the multi-select the table doesn't add those fields in <row> <panel depends="$ShowANI$"> <input type="multiselect" token="fieldsANI" searchWhenChanged="true" id="resized_input1"> <label>Add other Fields</label> <choice value="Codec">Codec</choice> <choice value="Codec_List">Codec_List</choice> <choice value="Dis_Init">Dis_Init</choice> <choice value="Sip_Resp">Sip_Resp</choice> <choice value="rnum">rnum</choice> <choice value="Minutes">Minutes</choice> <delimiter> </delimiter> </input> <table> <title>ANI Analysis (ANI Specified in Filter - use OR for multiple ANI's)</title> <search> <query>index=cdr_sbc2 ANI=$ANI$ Call_Ty=3 Called_Country=* | fillnull | eval Caller_Location=if(isnull(Caller_Location),"UnKnown",Caller_Location) | eval Market_Maker=if(isnull(Market_Maker),"Can't Find",Market_Maker) |stats count(_raw) AS Attempts, count(eval(Sip_Resp="200")) as Completed, count(eval(Dur="0")) as Zero_Duration, sum(Dur) AS Seconds by OTG,OTG_acctName,DTG,DTG_acctName,ANI,Caller_Location,Routing_Location,Market_Maker,direct_cic,rdest,Called_Country_ID,$fieldsANI$ | eval ASR=round(Completed/Attempts*100,2) | eval Minutes=round(Seconds/60,1) | eval ALOC=round(Minutes/Completed,2) | eval DTG_acctName=DTG_acctName+" ("+direct_cic+")" | eval Routing_Location=Routing_Location+" ("+rdest+")" | table OTG,OTG_acctName,DTG,DTG_acctName,ANI,Attempts,Completed,Caller_Location,Routing_Location,rdest,Called_Country_ID,ALOC,ASR,$fieldsANI$,Market_Maker | fields - Seconds | sort -Attempts</query> <earliest>$Time_Range.earliest$</earliest> <latest>$Time_Range.latest$</latest> </search> <option name="count">10</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <option name="wrap">false</option> <fields>["OTG","OTG_acctName","DTG","DTG_acctName","ANI","Attempts","Completed","Caller_Location","Routing_Location","ALOC","ASR","$fieldsANI$","Market_Maker"]</fields> <drilldown> <link target="_blank">https://art.comp.net/#/routes?country=$row.Called_Country_ID$&amp;location=$row.rdest$</link> </drilldown> </table> </panel> </row>   ... View more

Hi @jeffland ,  I just saw this as I was looking for a way to use a a field from a search in a drill-down link without using the <fields> tag because it was getting messed up by my multi-select input. Would you know how I can implement this properly    I did something wrong here. The token $fieldsANI$ is my multi-select.   I added in the underscore as you said to rdest and called_counrty_id and it hide it from the table but also from my drill-down.   <search> <query> ANI=$ANI$ | fillnull | eval Caller_Location=if(isnull(Caller_Location),"UnKnown",Caller_Location) by Caller_Location,Routing_Location,rdest,Called_Country_ID,$fieldsANI$ | eval Routing_Location=Routing_Location+" ("+rdest+")" | eval rdest=_rdest | eval Called_Country_ID=_Called_Country_ID | table Caller_Location,Routing_Location,_rdest,_Called_Country_ID,$fieldsANI$ | fields - Seconds | sort -Attempts</query> <earliest>$Time_Range.earliest$</earliest> <latest>$Time_Range.latest$</latest> </search> <option name="count">10</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <option name="wrap">false</option> <drilldown> <link target="_blank">https://art.comp.net/#/routing?country=$row._Called_Country_ID$&amp;location=$row._rdest$</link> </drilldown>   ... View more

Thank you very much for the answer! I tested it out and it all works amazing now! ... View more

then what value would I add to the end of my link? because I added $row.field$ and it didn't work. Could this be because I have at the end of my search query a |table fielda,fieldb.... ... View more

the auto option is working fine for my multi-select ... View more

Sorry I just looked this up and I found an answer adding in the <condition> tags blank treats the rest of the options as nothing <condition field="username"> <link target="_blank">https://www.facebook.com/=$row.username$/</link> </condition> <condition field="country"> <link target="_blank">https://www.google.com/maps/place/$row.country$/</link> </condition> <condition></condition> </drilldown> ... View more

Hi this works fine for me however when I now click on a field that is not one of the two in the condition it exits off the dashboard and into a search query ... View more

One more question I have for you. Can you explain the mix of the make results and the replace because when I looked at the documentation I didn't see anything with replace("$token$",","," ") I'm curious how it work for future reference. Thanks so much again I've really been searching Forums for days and nothing has worked! ... View more

Hi this didn't work for me. but thanks for the answer! ... View more

Hi this worked well! it did take longer for my search to get results but it worked!!! thank you so much can I vote you comment as the right answer? ... View more

Hi Rich Galloway I have tried that it hasn't worked either sadly Routing_Location="USA,Cellular_Verizon" | fillnull | rex field=Routing_Location mode=sed "s/,/ /g" | stats count(_raw) AS Attempts by ANI, Routing_Location | sort -Attempts Still comes up empty ... View more