topic Re: How to drilldown on a table that uses display values from a lookup in Dashboards & Visualizations

How to drilldown on a table that uses display values from a lookup

DaClyde — Wed, 29 Nov 2017 18:51:57 GMT

I have a dashboard with two levels of drilldowns. The first dashboard is a list of servers. Click on a server name and it gives you a list of that server's clients. Click on a client name and it shows you information from that client.

What I want to do is use a lookup to show a "friendly name" (like a business unit or division) instead of the actual server name. The problem I run into is that now the "friendly name" is what gets passed on as the $click.value$ to the client list. How can I display a "friendly name" but still have the drilldown use the original server name value on the drill down?

Re: How to drilldown on a table that uses display values from a lookup

somesoni2 — Wed, 29 Nov 2017 21:03:01 GMT

If you're using table visualization, you can have your search query to have both actual server name as well as friendly name, but use <fields> element to display only the friendly name. The actual server name will still be available at drilldown. You would've to use $row.fieldnameforActualServer$ instead of $click.value$ . See this

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/PanelreferenceforSimplifiedXML#table

Re: How to drilldown on a table that uses display values from a lookup

DaClyde — Mon, 04 Jun 2018 20:46:38 GMT

It has been awhile, but I'm back working on this. If I don't include the servername field in the <fields> list, it isn't passed in the drill down. If I include it in the <fields> list it shows up in the search results, but the drill down works.

What am I missing? How do I make the servername field available, but not visible in the initial results table?

Re: How to drilldown on a table that uses display values from a lookup

somesoni2 — Mon, 04 Jun 2018 21:20:09 GMT

Other option you've is, pass the "Friendly name" to drilldown/client search, and then where you're using host filter (earlier when you were using host name), use a subsearch which uses that friendly name to fetch host names from the lookup. E.g.

Server List query:

| inputlookup yourlookup.csv | table FriendlyNameCol, hostNameCol | stats count by FriendlyNameCol | table FriendlyNameCol

When clicked it'll pass FriendlyNameCol value as $click.value$ .

Client List query:

index=foo sourcetype=bar [ | inputlookup yourlookup.csv | where FriendlyNameCol="$drilldownToken$" | table hostNameCol] | .. rest of the search

Re: How to drilldown on a table that uses display values from a lookup

martin_mueller — Mon, 04 Jun 2018 21:27:13 GMT

Rename the ugly field to _uglyfield, and use $row._uglyfield$ in your drilldown. The underscore will make the table hide the field.

Re: How to drilldown on a table that uses display values from a lookup

DaClyde — Tue, 05 Jun 2018 13:54:58 GMT

Beautiful, that worked perfectly! Where is that little nugget in the documentation?

Re: How to drilldown on a table that uses display values from a lookup

martin_mueller — Tue, 05 Jun 2018 13:58:04 GMT

Not sure if it exists explicitly, but implicitly somewhere by stating that underscore fields are internal/hidden... Feel free to leave docs feedback in the dashboarding docs.

Re: How to drilldown on a table that uses display values from a lookup

DaClyde — Thu, 17 Jun 2021 21:04:28 GMT

3 years later, I'm finally getting around to using this and it works great. Thanks!