how to drilldown a row element to a child into splunk 6?

RiccardoV — Fri, 23 May 2014 14:16:27 GMT

Hi, I have something like this:

<form>
    <label>test</label>
    <searchTemplate>index=* sourcetype=$sourcetype$</searchTemplate>
    <fieldset>
      <input type="time">
          <label>1. Select a time range</label>
          <default>Always</default>
      </input>
      <input type="dropdown" token="sourcetype">
        <label>2. Select a sourcetype</label>
          <choice value="*">All</choice>
          <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype">
              | metadata type=sourcetypes index=* | fields sourcetype
          </populatingSearch>
      </input>
    </fieldset>
    <row>
      <table>
        <title>test table</title>
        <searchPostProcess>
          | stats count by ID
        </searchPostProcess>
      </table>
    </row>
</form>

How can I pass the field ID to a child element, ie a graph?
I took a look at the simple drilldown table into the splunk example app but I cannot understand.

With splunk 5 I did something like

      <table>
        <title>test table</title>
        <searchPostProcess>
          | stats count by ID
        </searchPostProcess>
        <option name="drilldown">cell</option>
        <html>
          <h1>$row.ID$</h1>
        </html>
      </table>

but now in splunk 6 it doesn't work, it pass the value to the search app (changing the current page) and not to the HTML child element.

Re: how to drilldown a row element to a child into splunk 6?

nfilippi_splunk — Fri, 23 May 2014 17:31:15 GMT

Correct, contextual drilldown is new to Simple XML in Splunk 6.1.

Re: how to drilldown a row element to a child into splunk 6?

RiccardoV — Mon, 26 May 2014 08:07:19 GMT

thanks! it works like a charm 🙂

topic how to drilldown a row element to a child into splunk 6? in Dashboards & Visualizations

how to drilldown a row element to a child into splunk 6?

Re: how to drilldown a row element to a child into splunk 6?

Re: how to drilldown a row element to a child into splunk 6?

Re: how to drilldown a row element to a child into splunk 6?