topic Re: drilldown click value issue in Dashboards & Visualizations

drilldown click value issue

ypfbkg — Mon, 28 Sep 2020 10:12:19 GMT

I have a hiddensearch：sourcetype="etrexacclog" instance="$instance$"

$instance$ is my click value

this click value is "server1:8080",but in my data , field instance data is "server:8080" or "server.ad.com:8080"

How could I set the click value to server1*:8080 (server1:8080 ==> server1*:8080)

Thanks.

Re: drilldown click value issue

jdunlea_splunk — Thu, 08 Dec 2011 12:33:08 GMT

Im not sure I understand? - If in your data, the value of "instance" is X, then the value of the click value should be X?

Are you saying that the click.value is different from the actual value of the field in the raw data??

Re: drilldown click value issue

RicoSuave — Thu, 08 Dec 2011 13:19:57 GMT

can you please post all of your advanced xml?

Re: drilldown click value issue

ypfbkg — Thu, 08 Dec 2011 13:47:40 GMT

Hello jdunlea_splunk,
yes, click.value is different from the actual value of the field in the raw data.

raw data have two "server1:8080" & "server1.ad.com:8080"
click.value only "server1:8080"
i need click.value be "server1*:8080" to search "server1:8080" & "server1.ad.com:8080"

Re: drilldown click value issue

eelisio2 — Fri, 09 Dec 2011 01:59:57 GMT

The replace() function should help:

sourcetype="etrexacclog"
| eval myfield="$instance$"
| eval myfield=replace(myfield,":",".ad.com:")
| where like(instance,"$instance$") OR like(instance,myfield)

Re: drilldown click value issue

ypfbkg — Fri, 09 Dec 2011 05:34:20 GMT

Hi eelisio2,

Thanks for your help. it works now.
and i learned the where function

Re: drilldown click value issue

eelisio2 — Fri, 09 Dec 2011 12:42:14 GMT

Glad to help. Good luck.