<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How too make a column value Clickable in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369897#M39761</link>
    <description>&lt;P&gt;if you have Splunk 7 you could do it throught the GUI:&lt;BR /&gt;
&lt;A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Drilldownonstatisticaltablerowsandcells"&gt;https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Drilldownonstatisticaltablerowsandcells&lt;/A&gt;&lt;/P&gt;</description>
    <pubDate>Wed, 21 Mar 2018 12:27:11 GMT</pubDate>
    <dc:creator>damiensurat</dc:creator>
    <dc:date>2018-03-21T12:27:11Z</dc:date>
    <item>
      <title>How too make a column value Clickable</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369893#M39757</link>
      <description>&lt;P&gt;I have a table that contains some columns.&lt;BR /&gt;
My requirement was to open  a URL on clicking the column value which i did but now i want to make those values clickable.&lt;BR /&gt;
Please suggest&lt;/P&gt;

&lt;P&gt;I have provided the drill down part below&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;      &amp;lt;link&amp;gt;
        &amp;lt;![CDATA[Respective link ]]&amp;gt;
      &amp;lt;/link&amp;gt;
    &amp;lt;/drilldown&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Thanks in advance&lt;/P&gt;</description>
      <pubDate>Wed, 21 Mar 2018 10:46:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369893#M39757</guid>
      <dc:creator>ASISH_9</dc:creator>
      <dc:date>2018-03-21T10:46:09Z</dc:date>
    </item>
    <item>
      <title>Re: How too make a column value Clickable</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369894#M39758</link>
      <description>&lt;P&gt;before  there is &lt;/P&gt;</description>
      <pubDate>Wed, 21 Mar 2018 10:48:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369894#M39758</guid>
      <dc:creator>ASISH_9</dc:creator>
      <dc:date>2018-03-21T10:48:17Z</dc:date>
    </item>
    <item>
      <title>Re: How too make a column value Clickable</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369895#M39759</link>
      <description>&lt;P&gt;Change the format of the display through UI to click selection as "CELL",  and use following tokens to send those name value pairs to destination link.&lt;/P&gt;

&lt;P&gt;dirldownlink?$click.name2$=$click.value2$&lt;/P&gt;</description>
      <pubDate>Wed, 21 Mar 2018 11:29:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369895#M39759</guid>
      <dc:creator>kyaparla</dc:creator>
      <dc:date>2018-03-21T11:29:53Z</dc:date>
    </item>
    <item>
      <title>Re: How too make a column value Clickable</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369896#M39760</link>
      <description>&lt;P&gt;so you want both the column name and the clicked value passed through?&lt;/P&gt;</description>
      <pubDate>Wed, 21 Mar 2018 12:06:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369896#M39760</guid>
      <dc:creator>cmerriman</dc:creator>
      <dc:date>2018-03-21T12:06:15Z</dc:date>
    </item>
    <item>
      <title>Re: How too make a column value Clickable</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369897#M39761</link>
      <description>&lt;P&gt;if you have Splunk 7 you could do it throught the GUI:&lt;BR /&gt;
&lt;A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Drilldownonstatisticaltablerowsandcells"&gt;https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Drilldownonstatisticaltablerowsandcells&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 21 Mar 2018 12:27:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369897#M39761</guid>
      <dc:creator>damiensurat</dc:creator>
      <dc:date>2018-03-21T12:27:11Z</dc:date>
    </item>
    <item>
      <title>Re: How too make a column value Clickable</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369898#M39762</link>
      <description>&lt;P&gt;If you are attempting to do it through simple xml:&lt;BR /&gt;
&lt;A href="http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#drilldown"&gt;SimpifedXMLDrilldown on Splunk Docs&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;On that Page Scroll down to the Predefined Drilldown Tokens section, then look under the Table subsection.  Here are the options I believe you may be looking for EG:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;**table**
**Token** 
Description 

$click.name$ Leftmost field (column) name in the table. Typically, _time is leftmost in a table that includes this field and where columns are ordered by default.  
$click.value$  Leftmost field (column) value in the clicked table row.  
$click.name2$  Clicked field (column) name. In a &amp;lt;condition&amp;gt; element configuring drilldown in a table, field corresponds to $click.name2$.  
$click.value2$  Clicked field (column) value. Use this token to capture the specific table cell value that users click.  
$row.&amp;lt;fieldname&amp;gt;$  Access any field (column) value from the clicked table row.  
$earliest$  Earliest time for the clicked table row. If not applicable, uses the earliest time of the search.  
$latest$  Latest time for the clicked table row. If not applicable, uses the latest time of the search.  
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;An Example in dashboard usage:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Example

A click on the table sets a token which is consumed by the search of the chart visualization. 

&amp;lt;dashboard&amp;gt;
  &amp;lt;label&amp;gt;In-page Drilldown&amp;lt;/label&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;title&amp;gt;Set sourcetype token on click&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;
          index=_internal | stats count by sourcetype
          &amp;lt;/query&amp;gt;
        &amp;lt;earliest&amp;gt;-1h&amp;lt;/earliest&amp;gt;
        &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;drilldown&amp;gt;
          &amp;lt;condition field="sourcetype"&amp;gt;
            &amp;lt;set token="sourcetype"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;
          &amp;lt;/condition&amp;gt;
        &amp;lt;/drilldown&amp;gt;
      &amp;lt;/table&amp;gt;
      &amp;lt;chart&amp;gt;
        &amp;lt;title&amp;gt;Chart for $sourcetype$&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;
            index=_internal sourcetype=$sourcetype$ | timechart count by sourcetype
          &amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-1h&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
      &amp;lt;/chart&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/dashboard&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So as for what you are looking for, assuming you want the clicked value to be part of the link:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;table&amp;gt;
&amp;lt;search&amp;gt;index=_internal&amp;lt;/search&amp;gt;

&amp;lt;!-- Pass the clicked cell's value, earliest time, --&amp;gt;
&amp;lt;!-- and latest time to a destination form's       --&amp;gt;
&amp;lt;!-- token ('foo') and search parameters           --&amp;gt;
&amp;lt;drilldown&amp;gt;
  &amp;lt;link&amp;gt;
  &amp;lt;![CDATA[
/app/search/simple_xml_form?form.foo=$click.value2$&amp;amp;earliest=$earliest$&amp;amp;latest=$latest$
  ]]&amp;gt;
  &amp;lt;/link&amp;gt;
&amp;lt;/drilldown&amp;gt;
&amp;lt;/table&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;You can find many more examples in the drilldown section of the link above.&lt;/P&gt;</description>
      <pubDate>Wed, 21 Mar 2018 12:39:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-too-make-a-column-value-Clickable/m-p/369898#M39762</guid>
      <dc:creator>damiensurat</dc:creator>
      <dc:date>2018-03-21T12:39:34Z</dc:date>
    </item>
  </channel>
</rss>

