topic Re: How do I use a value from a different field in drilldown? in Dashboards & Visualizations

How do I use a value from a different field in drilldown?

ZacEsa — Tue, 29 Sep 2020 22:36:14 GMT

Right now, when I click on the value in column two, I can use the values in column one and two with $click.value$ and $click.value2$. However, if I click on the value in column one, I can only use the value in column one with $click.value$. $click.value2$ basically becomes the same as $click.value$.

Example;
If I click on {row_one, column_two}, $cell.value$ = 1 and $cell.value2$ = 3
If I click on {row_one, column_one}, $cell.value$ = 1 and $cell.value2$ = 1

So, how do I use the value of {row_one, column_two} even if only {row_one, column_one} is clicked?

Re: How do I use a value from a different field in drilldown?

ZacEsa — Tue, 29 Sep 2020 22:36:17 GMT

Okay, I didn't test it out before but strangely, if I click on {row_one, column_three}, then $cell.value2$ = 5.

Re: How do I use a value from a different field in drilldown?

harsmarvania57 — Tue, 29 Sep 2020 22:40:13 GMT

Hi @ZacEsa,

In drilldown, $click.value$ is value of the first cell in row however $click.value2$ is actual clicked cell value.

For example
If you click on row_one, column_three it will give you $click.value$=1 and $click.value2$=5
If you click on row_two, column_four it will give you $click.value$=2 and $click.value2$=8

If you would like to use 2nd column value from every row in drilldown then you can use $row.column_two$

So based your data when you click anywhere in first row it will give you $row.column_two$=3 and in 2nd row it will give you $row.column_two$=4

Re: How do I use a value from a different field in drilldown?

niketn — Tue, 08 Jan 2019 12:07:38 GMT

@ZacEsa you can always use $row.column_one$ , $row.column_two$ , $row.column_three$ ... to fetch value from any column from the row where a particular cell is clicked. $click.value$ is for first column in the table and $click.value2$ is for current cell.

Refer to Splunk Documentation : https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#Drilldown_event_tokens

Re: How do I use a value from a different field in drilldown?

niketn — Tue, 08 Jan 2019 12:08:15 GMT

Guess I was late 🙂

Re: How do I use a value from a different field in drilldown?

harsmarvania57 — Tue, 08 Jan 2019 12:12:54 GMT

lol ....:)

Re: How do I use a value from a different field in drilldown?

ZacEsa — Tue, 08 Jan 2019 13:55:30 GMT

Actually, I tried with the row but, my column name is like, Device Name: so, when I tried $row.Device Name:$, it didn’t work. Is there any special format or I can’t rename it as such if I want to use the drill down?

Re: How do I use a value from a different field in drilldown?

harsmarvania57 — Tue, 08 Jan 2019 14:02:48 GMT

I suggest to rename column name in main query | rename "Device Name:" as Device_Name and then use $row.Device_Name$ in drilldown.

Re: How do I use a value from a different field in drilldown?

ZacEsa — Wed, 09 Jan 2019 08:50:51 GMT

I actually renamed it to "Device Name:" so that it looks nicer on the dashboard. So, I can't use a nice name if I want to use a custom drilldown?

Re: How do I use a value from a different field in drilldown?

harsmarvania57 — Wed, 09 Jan 2019 12:37:08 GMT

I don't know how to use : in token but if you can use Device Name instead of Device Name: for column header then try $row.Device Name$

Re: How do I use a value from a different field in drilldown?

ZacEsa — Thu, 10 Jan 2019 08:09:14 GMT

Hadn't tried it but I'll accept your answer and use Device_Name for now. Thanks!