Dashboards & Visualizations

PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'rangemap' command

alenseb
Communicator

Hi,

I am getting this error while trying to drilldown.
How do i escape this issue as i need to use RangeMap.

This is the code i am using:
sourcetype="Log1" | join type=inner UsrName [SEARCH sourcetype="Log2"] | rangemap field=count green=0-4 blue=5-20 red=21-50 default=red

Please Help.
Thanks!

Tags (2)
1 Solution

MarioM
Motivator

in drilldown rangemap,fieldformat,eval,... cannot be the last search command then you need add another search command ie |stats, |table,...

View solution in original post

MarioM
Motivator

in drilldown rangemap,fieldformat,eval,... cannot be the last search command then you need add another search command ie |stats, |table,...

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...