<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Clickable Chart To Show Different Tables when Clicked? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Clickable-Chart-To-Show-Different-Tables-when-Clicked/m-p/620072#M106873</link>
    <description>&lt;P&gt;I have 4 Single Values that show different values, and I want to be able to click on each of them and then bring up a table below showing my information. I currently have this set for one of the single values, which shows the number of failed MFA challenges. So when that value is clicked, a table opens up to display the account id, email address, another id number and a timestamp.&lt;/P&gt;
&lt;P&gt;Here is the code for the single value:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index=keycloak "MFA"
| regex _raw="MFA challenge failed"
| stats count&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;and here is the code I have for the statistics table that opens when the single value is clicked:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index=keycloak "MFA"
| eval ONE="$failed$"
| rex "account\s+(?&amp;lt;account&amp;gt;\w+)\s+with\s+email\s+(?&amp;lt;email&amp;gt;[^ ]+)\s+\w+\s+\w+\s+\w+\s+\w+\s+(?&amp;lt;keycloak_id&amp;gt;[a-z,0-9,-]+)"
| where isnotnull (account)
| table account, email, keycloak_id, _time&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The eval ONE="$failed$" is corresponding to the drilldown editor for the single value, which is as follows:&lt;/P&gt;
&lt;P&gt;On Click: Manage tokens on this dashboard&lt;/P&gt;
&lt;P&gt;Set failed = $click.value2$&lt;/P&gt;</description>
    <pubDate>Tue, 08 Nov 2022 16:06:54 GMT</pubDate>
    <dc:creator>jhilton90</dc:creator>
    <dc:date>2022-11-08T16:06:54Z</dc:date>
    <item>
      <title>Clickable Chart To Show Different Tables when Clicked?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Clickable-Chart-To-Show-Different-Tables-when-Clicked/m-p/620072#M106873</link>
      <description>&lt;P&gt;I have 4 Single Values that show different values, and I want to be able to click on each of them and then bring up a table below showing my information. I currently have this set for one of the single values, which shows the number of failed MFA challenges. So when that value is clicked, a table opens up to display the account id, email address, another id number and a timestamp.&lt;/P&gt;
&lt;P&gt;Here is the code for the single value:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index=keycloak "MFA"
| regex _raw="MFA challenge failed"
| stats count&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;and here is the code I have for the statistics table that opens when the single value is clicked:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index=keycloak "MFA"
| eval ONE="$failed$"
| rex "account\s+(?&amp;lt;account&amp;gt;\w+)\s+with\s+email\s+(?&amp;lt;email&amp;gt;[^ ]+)\s+\w+\s+\w+\s+\w+\s+\w+\s+(?&amp;lt;keycloak_id&amp;gt;[a-z,0-9,-]+)"
| where isnotnull (account)
| table account, email, keycloak_id, _time&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The eval ONE="$failed$" is corresponding to the drilldown editor for the single value, which is as follows:&lt;/P&gt;
&lt;P&gt;On Click: Manage tokens on this dashboard&lt;/P&gt;
&lt;P&gt;Set failed = $click.value2$&lt;/P&gt;</description>
      <pubDate>Tue, 08 Nov 2022 16:06:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Clickable-Chart-To-Show-Different-Tables-when-Clicked/m-p/620072#M106873</guid>
      <dc:creator>jhilton90</dc:creator>
      <dc:date>2022-11-08T16:06:54Z</dc:date>
    </item>
    <item>
      <title>Re: Clickable Chart To Show Different Tables when Clicked</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Clickable-Chart-To-Show-Different-Tables-when-Clicked/m-p/620135#M106882</link>
      <description>&lt;P&gt;What is your question?&lt;/P&gt;</description>
      <pubDate>Tue, 08 Nov 2022 14:52:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Clickable-Chart-To-Show-Different-Tables-when-Clicked/m-p/620135#M106882</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2022-11-08T14:52:57Z</dc:date>
    </item>
    <item>
      <title>Re: Clickable Chart To Show Different Tables when Clicked</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Clickable-Chart-To-Show-Different-Tables-when-Clicked/m-p/620141#M106883</link>
      <description>&lt;P&gt;&lt;SPAN&gt;I have 4 Single Values that show different values, and I want to be able to click on each of them and then bring up a table below showing my information.&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 08 Nov 2022 15:15:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Clickable-Chart-To-Show-Different-Tables-when-Clicked/m-p/620141#M106883</guid>
      <dc:creator>jhilton90</dc:creator>
      <dc:date>2022-11-08T15:15:53Z</dc:date>
    </item>
    <item>
      <title>Re: Clickable Chart To Show Different Tables when Clicked</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Clickable-Chart-To-Show-Different-Tables-when-Clicked/m-p/620150#M106885</link>
      <description>&lt;P&gt;Does the code you shared not do that?&amp;nbsp; How does it not meet expectations?&lt;/P&gt;</description>
      <pubDate>Tue, 08 Nov 2022 16:04:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Clickable-Chart-To-Show-Different-Tables-when-Clicked/m-p/620150#M106885</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2022-11-08T16:04:55Z</dc:date>
    </item>
  </channel>
</rss>

