topic Re: How can I drilldown values from a hidden field? in Dashboards & Visualizations

How can I drilldown values from a hidden field?

pamcarvalho — Tue, 17 Oct 2017 13:54:10 GMT

Hey!

I am building a dashboard and this problem is being a headache. I really need to find a way to drilldown values from hidden fields and/or panels, but not sure how to do so.. Can anyone help me, please?
Thanks in advance!

Re: How can I drilldown values from a hidden field?

gcusello — Tue, 17 Oct 2017 14:16:51 GMT

Hi pamcarvalho,
create your search, e.g.:

index=my_index
| table _time field1 field2 hidden_field

in the panel options put the tag

<fields>_time,field1,field2</fields>

then in drilldown you can use hidden_field

Bye.
Giuseppe

Re: How can I drilldown values from a hidden field?

pamcarvalho — Tue, 17 Oct 2017 14:23:53 GMT

But that only works assuming that someone clicks on the table right? Is there a way do display the field value without depending on that?

Re: How can I drilldown values from a hidden field?

pamcarvalho — Tue, 17 Oct 2017 14:25:09 GMT

For example, a hidden panel that has a table with only one field value. Is it possible to drilldown this value?

Re: How can I drilldown values from a hidden field?

gcusello — Tue, 17 Oct 2017 14:42:01 GMT

a drilldown starts always from a click on a Splunk object!
Do you want to automatically open a dashboard from another one?
Why?
bye.
Giuseppe

Re: How can I drilldown values from a hidden field?

pamcarvalho — Tue, 17 Oct 2017 17:22:26 GMT

No, l want to drilldown a value, change its format and then drilldown the new value. But the intermediary value shouldn't show up.. Not sure if I made myself clear..

Re: How can I drilldown values from a hidden field?

jeffland — Thu, 19 Oct 2017 09:00:16 GMT

Based on your comments, what you might be looking for is something like this:

<table>
  <search>
    <query>data=A | table info date</query>
  </search>
  <drilldown>
    <eval token="drilldown_token">strftime(strptime('row.date', "%F"), "%d.%m.%Y")</eval>
  </drilldown>
</table>
...
<table depends="$drilldown_token$">
  <search>
    <query>data=B | search other_date="$drilldown_token$"</query>
  </search>
</table>

This allows you to have a value passed to the drilldown that is not visible in the table you drilled down from. In the case above, imagine having a date like "2017-10-19" in the table you drill down from while you need it as "19.10.2017" in your target search.

Re: How can I drilldown values from a hidden field?

pamcarvalho — Thu, 19 Oct 2017 16:23:15 GMT

Yes!!!! That's it! Thank you very much!

Re: How can I drilldown values from a hidden field?

pamcarvalho — Wed, 25 Oct 2017 13:44:56 GMT

Just an update, this wasn't working for me but I found a way to do it, so in case that helps anyone, this is what I did:

<drilldown>
          <eval token="EOEDDE">strftime('earliest',"%d/%m/%y")</eval>
          <eval token="EOEDDL">strftime('latest',"%d/%m/%y")</eval>
          <set token="EOEDD">$earliest$</set>
          <set token="EOLDD">$latest$</set>
</drilldown>

I used "EOEDDE" and "EOEDDL" for the panel title. "EOEDD" and "EOLDD" to generate results to a table.