<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Using  a Column not in the table for a drilldown link (without using &amp;lt;fields&amp;gt; tag) in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514693#M34397</link>
    <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/87518"&gt;@FrankVl&lt;/a&gt;&amp;nbsp; I found the Answer in&amp;nbsp;&lt;A href="https://community.splunk.com/t5/Dashboards-Visualizations/How-to-drilldown-on-a-table-that-uses-display-values-from-a/m-p/307662#M19635" target="_self"&gt;this&lt;/A&gt;&amp;nbsp;post I see your original point was correct i had it wrong&lt;/P&gt;</description>
    <pubDate>Tue, 18 Aug 2020 13:02:27 GMT</pubDate>
    <dc:creator>jamieadahan</dc:creator>
    <dc:date>2020-08-18T13:02:27Z</dc:date>
    <item>
      <title>Using  a Column not in the table for a drilldown link (without using &lt;fields&gt; tag)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514674#M34389</link>
      <description>&lt;P&gt;I need to use a field for a drill-down link that can't be in the table Normally I would use the answer from&amp;nbsp;&lt;A href="https://community.splunk.com/t5/Dashboards-Visualizations/How-to-extract-a-value-between-parentheses-and-use-it-for-a/m-p/514406#M34356" target="_self"&gt;here&lt;/A&gt;&amp;nbsp; which is to use the &amp;lt;fields&amp;gt; tag in the XML area however since I have a multi-select in my search which adds to the tables &amp;lt;fields&amp;gt; wont work.&amp;nbsp; In the Link I posted someone suggested that I use an underscore however that did work for me. Can anyone tell me what I am doing wrong here? or if there is a way to use &amp;lt;fields&amp;gt; with a multi-select.&amp;nbsp;&lt;SPAN&gt;The token $fieldsANI$ is my multi-select&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt; &amp;lt;panel depends="$ShowANI$"&amp;gt;
      &amp;lt;input type="multiselect" token="fieldsANI" searchWhenChanged="true" id="resized_input1"&amp;gt;
        &amp;lt;label&amp;gt;Add other Fields&amp;lt;/label&amp;gt;
        &amp;lt;choice value="Codec"&amp;gt;Codec&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="Codec_List"&amp;gt;Codec_List&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="Dis_Init"&amp;gt;Dis_Init&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="Sip_Resp"&amp;gt;Sip_Resp&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="rnum"&amp;gt;rnum&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="Minutes"&amp;gt;Minutes&amp;lt;/choice&amp;gt;
        &amp;lt;delimiter&amp;gt; &amp;lt;/delimiter&amp;gt;
&amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt; ANI=$ANI$ 
| fillnull   
| eval Caller_Location=if(isnull(Caller_Location),"UnKnown",Caller_Location)
 
by Caller_Location,Routing_Location,rdest,Called_Country_ID,$fieldsANI$
| eval Routing_Location=Routing_Location+" ("+rdest+")"
| eval rdest=_rdest
| eval Called_Country_ID=_Called_Country_ID
| table Caller_Location,Routing_Location,_rdest,_Called_Country_ID,$fieldsANI$
| fields - Seconds
| sort -Attempts&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;$Time_Range.earliest$&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;$Time_Range.latest$&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt; 
        &amp;lt;option name="count"&amp;gt;10&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;
        &amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;drilldown&amp;gt;
            &amp;lt;link target="_blank"&amp;gt;https://art.comp.net/#/routing?country=$row._Called_Country_ID$&amp;amp;amp;location=$row._rdest$&amp;lt;/link&amp;gt;
        &amp;lt;/drilldown&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 18 Aug 2020 11:42:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514674#M34389</guid>
      <dc:creator>jamieadahan</dc:creator>
      <dc:date>2020-08-18T11:42:47Z</dc:date>
    </item>
    <item>
      <title>Re: Using  a Column not in the table for a drilldown link (without using &lt;fields&gt; tag)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514677#M34391</link>
      <description>&lt;P&gt;Did some piece of the query go missing where that blank line is? If this is how it actually is in your dashboard, that might explain why the query doesn't work.&lt;/P&gt;&lt;P&gt;Also, I think this eval is the wrong way around:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Called_Country_ID=_Called_Country_ID&lt;/LI-CODE&gt;&lt;P&gt;Also, not entirely sure why you can't use the &amp;lt;fields&amp;gt; approach here. You can also use the token inside that &amp;lt;fields&amp;gt; definition, right?&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 18 Aug 2020 11:56:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514677#M34391</guid>
      <dc:creator>FrankVl</dc:creator>
      <dc:date>2020-08-18T11:56:43Z</dc:date>
    </item>
    <item>
      <title>Re: Using  a Column not in the table for a drilldown link (without using &lt;fields&gt; tag)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514679#M34392</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/87518"&gt;@FrankVl&lt;/a&gt;&amp;nbsp; Let me share with you the full query with the links&amp;nbsp; this is it with attempting to use the &amp;lt;fields&amp;gt; tag&amp;nbsp;&lt;/P&gt;&lt;P&gt;The Drill-down part works however when I try to add fields into the multi-select the table doesn't add those fields in&lt;/P&gt;&lt;LI-CODE lang="markup"&gt; &amp;lt;row&amp;gt;
    &amp;lt;panel depends="$ShowANI$"&amp;gt;
      &amp;lt;input type="multiselect" token="fieldsANI" searchWhenChanged="true" id="resized_input1"&amp;gt;
        &amp;lt;label&amp;gt;Add other Fields&amp;lt;/label&amp;gt;
        &amp;lt;choice value="Codec"&amp;gt;Codec&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="Codec_List"&amp;gt;Codec_List&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="Dis_Init"&amp;gt;Dis_Init&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="Sip_Resp"&amp;gt;Sip_Resp&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="rnum"&amp;gt;rnum&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="Minutes"&amp;gt;Minutes&amp;lt;/choice&amp;gt;
        &amp;lt;delimiter&amp;gt; &amp;lt;/delimiter&amp;gt;
      &amp;lt;/input&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;title&amp;gt;ANI  Analysis (ANI Specified in Filter - use OR for multiple ANI's)&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;index=cdr_sbc2 ANI=$ANI$ Call_Ty=3 Called_Country=* | fillnull    | eval Caller_Location=if(isnull(Caller_Location),"UnKnown",Caller_Location)  | eval Market_Maker=if(isnull(Market_Maker),"Can't Find",Market_Maker) |stats count(_raw) AS Attempts, count(eval(Sip_Resp="200")) as Completed, count(eval(Dur="0")) as Zero_Duration, sum(Dur) AS Seconds by OTG,OTG_acctName,DTG,DTG_acctName,ANI,Caller_Location,Routing_Location,Market_Maker,direct_cic,rdest,Called_Country_ID,$fieldsANI$
| eval ASR=round(Completed/Attempts*100,2)
| eval Minutes=round(Seconds/60,1)
| eval ALOC=round(Minutes/Completed,2)
| eval DTG_acctName=DTG_acctName+" ("+direct_cic+")"
| eval Routing_Location=Routing_Location+" ("+rdest+")"
| table OTG,OTG_acctName,DTG,DTG_acctName,ANI,Attempts,Completed,Caller_Location,Routing_Location,rdest,Called_Country_ID,ALOC,ASR,$fieldsANI$,Market_Maker
| fields - Seconds
| sort -Attempts&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;$Time_Range.earliest$&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;$Time_Range.latest$&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt; 
        &amp;lt;option name="count"&amp;gt;10&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;
        &amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;fields&amp;gt;["OTG","OTG_acctName","DTG","DTG_acctName","ANI","Attempts","Completed","Caller_Location","Routing_Location","ALOC","ASR","$fieldsANI$","Market_Maker"]&amp;lt;/fields&amp;gt;
        &amp;lt;drilldown&amp;gt;
            &amp;lt;link target="_blank"&amp;gt;https://art.comp.net/#/routes?country=$row.Called_Country_ID$&amp;amp;amp;location=$row.rdest$&amp;lt;/link&amp;gt;
        &amp;lt;/drilldown&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 18 Aug 2020 12:10:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514679#M34392</guid>
      <dc:creator>jamieadahan</dc:creator>
      <dc:date>2020-08-18T12:10:52Z</dc:date>
    </item>
    <item>
      <title>Re: Using  a Column not in the table for a drilldown link (without using &lt;fields&gt; tag)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514680#M34393</link>
      <description>&lt;P&gt;I think that is because&amp;nbsp;&lt;/P&gt;&lt;PRE&gt;"$fieldsANI$"&lt;/PRE&gt;&lt;P&gt;resolves to "Codec,Codec_List" for example. While you would need "Codec","Codec_List".&lt;/P&gt;&lt;P&gt;Playing around with the token prefix/suffix/delimeter settings on the multiselect might provide a way to format the content of the token in a way that it does work (and still works in the table command as well).&lt;/P&gt;</description>
      <pubDate>Tue, 18 Aug 2020 12:26:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514680#M34393</guid>
      <dc:creator>FrankVl</dc:creator>
      <dc:date>2020-08-18T12:26:22Z</dc:date>
    </item>
    <item>
      <title>Re: Using  a Column not in the table for a drilldown link (without using &lt;fields&gt; tag)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514686#M34396</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/87518"&gt;@FrankVl&lt;/a&gt;&amp;nbsp;So this Semi worked as when I played around with it I did get it to work however i believe the &amp;lt;fields&amp;gt; tag does refresh as much as the table does so when I took out some values and added others in the table would keep what the fields tag had in it originally. I had to refresh the page for it to add the next multi-select input. Is there a way I can force a refresh?&lt;/P&gt;</description>
      <pubDate>Tue, 18 Aug 2020 12:43:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514686#M34396</guid>
      <dc:creator>jamieadahan</dc:creator>
      <dc:date>2020-08-18T12:43:58Z</dc:date>
    </item>
    <item>
      <title>Re: Using  a Column not in the table for a drilldown link (without using &lt;fields&gt; tag)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514693#M34397</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/87518"&gt;@FrankVl&lt;/a&gt;&amp;nbsp; I found the Answer in&amp;nbsp;&lt;A href="https://community.splunk.com/t5/Dashboards-Visualizations/How-to-drilldown-on-a-table-that-uses-display-values-from-a/m-p/307662#M19635" target="_self"&gt;this&lt;/A&gt;&amp;nbsp;post I see your original point was correct i had it wrong&lt;/P&gt;</description>
      <pubDate>Tue, 18 Aug 2020 13:02:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-Column-not-in-the-table-for-a-drilldown-link-without/m-p/514693#M34397</guid>
      <dc:creator>jamieadahan</dc:creator>
      <dc:date>2020-08-18T13:02:27Z</dc:date>
    </item>
  </channel>
</rss>

