topic splunk dynamic drilldown shows variable instead of value in Dashboards & Visualizations

splunk dynamic drilldown shows variable instead of value

sanchitguptaiit — Thu, 04 Jun 2015 02:37:28 GMT

I am trying to define a drilldown within a splunk form. However, when i click the row, it passes the variable $row.rid$ instead of the value.

Can someone where help what i am doing wrong?

Here is the code

 <panel>
      <table>
        <title>Error Details</title>
        <search>
          <query>host="vmh001d009" index="coreservices"  | transaction rid | search (level=ERROR OR level=FATAL)  | rex field=url "http://(?<Service>[^/]+/[^/]+)" | eval Time=strftime(_time, "%H:%M %P %Z") | table Time, Service, funcname, user | rename funcname as Function, user as User</query>
          &lt;earliest&gt;$timeSelection.earliest$&lt;/earliest&gt;
          &lt;latest&gt;$timeSelection.latest$&lt;/latest&gt;
        </search>
        <drilldown>
          &lt;link&gt;/app/coreservicesmonitoring/ptpe__debug?form.rid=$row.rid$&lt;/link&gt;
        </drilldown>
        <option name="wrap">false</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <option name="drilldown">row</option>
      </table>
    </panel>

Here is what it resolves too; (note form.rid=%24row.rid%24 )

https://prodsplunk/en-US/app/coreservicesmonitoring/ptpe__debug?form.rid=%24row.rid%24&form.time.earliest=0&form.time.latest&earliest=0&latest=

Re: splunk dynamic drilldown shows variable instead of value

gyslainlatsa — Thu, 04 Jun 2015 08:36:16 GMT

hi sanchitguptaiitd,

For this to work, there will have to be rida field that appears in the final table and you have displayed among the fields you want to display with the control table, I see no rid.
for the syntax of the drilldown tag, everything is correct and should work.
try as I say, and let me know.

Here the sample code I used recently and it retrieves the exact value.

 <panel>
      <table id="master">
        <title>Tickets for $host$, $status$, generated by Error_alert, triggered</title>
        <search>
          <query>index=ticket report="ticket1" $host$ $TicketNumber$ $status$ $comment$ |dedup TicketNumber
             |table TicketNumber Alerttime status Comments Raw 
          </query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>

        <drilldown>
          <!-- Use set to specify the new token to be created.
            Use any token from the page or from the click event to produce the value needed. -->  
          <link>/app/CPU/tickets_list2?form.TicketNumber=$row.TicketNumber$</link>
        </drilldown>
        <option name="count">10</option>
      </table>
    </panel>

please forgive My english

Re: splunk dynamic drilldown shows variable instead of value

sanchitguptaiit — Fri, 05 Jun 2015 01:16:19 GMT

thanks, that worked! i assumed i could use any fields in underlying event, guess only those shown up in table can be passed.

Thanks again for your help

Re: splunk dynamic drilldown shows variable instead of value

gyslainlatsa — Fri, 05 Jun 2015 08:29:10 GMT

thanks, If it works; must then accepted