topic Re: Search drilldown - limited clickability in Dashboards & Visualizations

Search drilldown - limited clickability

mhaurosh — Fri, 10 Aug 2012 10:19:45 GMT

we use 'HiddenSearch' with 'ConvertToIntention' to display results from the 2nd search in the same view.

How can we may only the "Lease IP" cell clickable but not other columns?

Below is the view:



      
        sourcetype=ib:dhcp:lease_history index=ib_dhcp_lease_history | rename host as "Member", ACTION as "Action", LEASE_IP as "Lease IP" | table _time, Member, Action, "Lease IP"
    
        
          true
          false
          
            results
            
            all
            
            
                      sourcetype=ib:dhcp:lease_history index=ib_dhcp_lease_history | rename host as "Member", ACTION as "Action", LEASE_IP as "Lease IP" | table _time, Member, Action, "Lease IP"
    


                        
                          addterm
                          
                            $click.value2$
                          
                         


                
                  results
                  
                DHCP Lease History for LEASE IP=$click.value2$
                  
                 


                       
             
         

 
          
          
            addinfo | eval TUPDATE=strftime(info_search_time, "%Y-%m-%d %H:%M:%S %Z")
            
              TUPDATE
              Last Updated:

Thanks!

Michael

Re: Search drilldown - limited clickability

sideview — Fri, 10 Aug 2012 19:47:08 GMT

Well if you want to keep using just the core splunk modules, what I recommend is

1) change the "drilldown" param of your table from "all" to "row". This will make the entire row highlight instead of the given cell. This will also make the click.value be the first row of the table, no matter what.

2) You then of course have to reorder the fields with your table command, such that the LEASE IP field is indeed the first column.

If you want to eliminate the need to re-order your fields then you could start using Sideview Utils in your views, because Sideview Utils patches the SimpleResultsTable module so as to output other keys like $click.fields.Lease IP$ so you can use more than just the first column value. You'd also get some side bonuses, like you wouldn't need to use ConvertToIntention anymore.

http://sideviewapps.com/apps/sideview-utils/

Re: Search drilldown - limited clickability

mhaurosh — Mon, 13 Aug 2012 14:43:28 GMT

Sideview Utils is exactly what was needed.
Thanks!