topic Re: How do I create a drilldown for a specific cell location (not cell value) in a table? in Splunk Search

How do I create a drilldown for a specific cell location (not cell value) in a table?

nick405060 — Thu, 04 Oct 2018 23:40:44 GMT

Hi there,

I read a bunch of related Splunk answers, but so far I haven't seen a solution posted to creating a drilldown for a specific cell location in a table, other than by relying on the cell value. If you think of it like an Excel spreadsheet:

.. A B C D E F
1
2
3
4
5

I need a drilldown on A2 only, not A1 or B2. It doesn't matter what the value of A2 is, clicking on that value needs to drilldown.

Thanks to xpac and rohit sharma2 for helping me out on this in the chatroom and mentioning click.value2 and row.field1, but looks like those don't quite offer a solution

Re: How do I create a drilldown for a specific cell location (not cell value) in a table?

niketn — Fri, 05 Oct 2018 02:59:14 GMT

@nick405060 if I understand the question.... Only if the cell value clicked in the table is value A2 you want to populate the same in text box?

Is it at a fixed column/row or can it be at any column/row location? Also can there be multiple value A2s in your table?

On a different note can you give a background of the use case, as to why only value A2 and what after populating in the text box? Are you planning to update some token and perform further activity/ies?

Re: How do I create a drilldown for a specific cell location (not cell value) in a table?

nick405060 — Fri, 05 Oct 2018 17:23:26 GMT

See edited post.

Re: How do I create a drilldown for a specific cell location (not cell value) in a table?

niketn — Fri, 05 Oct 2018 19:06:16 GMT

@nick405060 would you know all the field names i.e. A, B, C, D, E? Also would there be a fixed maximum number of fields i.e. 5 or more?

Re: How do I create a drilldown for a specific cell location (not cell value) in a table?

nick405060 — Fri, 05 Oct 2018 19:10:37 GMT

In my case, yes to both!

Re: How do I create a drilldown for a specific cell location (not cell value) in a table?

niketn — Fri, 05 Oct 2018 19:21:45 GMT

Would it be possible for you to share your drilldown code as to what you have tried? or else explain what is the drilldown action you need to perform? Like whether you just need the First Column Second Row value to be set as a token or is it drilldown link to launch a new Splunk Internal or External URL?

Re: How do I create a drilldown for a specific cell location (not cell value) in a table?

niketn — Fri, 05 Oct 2018 19:44:58 GMT

Please try the following approach

Step 1: Add | streamstats count as sno after your current transforming command to get the row number for each table rows.
Step 2: Since you know all the possible field names and count remains five use <fields> Simple XML Table Configuration to keep only the required 5 columns (lets say field1, field2, field3, field4 and field5) and hide sno field which retains the table row number for drilldown.
Step 3: Use match condition with $click.name2$ to identify first field i.e. field1 and $row.sno$ to get the row number i.e. 2.

Please try the following run anywhere dashboard based on Splunk's _internal index which has only three columns for simplicity of example but it drills down to set token only if first column i.e. component and its corresponding value in the second row is clicked. Otherwise it remains unset.

PS: I have used tokens for Column and Row to test whether the drilldown is setting/unsetting the token as expected or not.

Following is run anywhere Simple XML Code for the Dashboard:

<dashboard>
  <label>Table First Column Second Row Drilldown</label>
  <row>
    <panel>
      <html>
        <div>tokClickedColumn: $tokClickedColumn$</div>
        <div>tokClickedRow= $tokClickedRow$</div>
        <div>tokFirstColumnSecondRowClicked: $tokFirstColumnSecondRowClicked$</div>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <title></title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| stats count by component log_level
| streamstats count as sno
| table sno *</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <fields>component,log_level,count</fields>
        <drilldown>
          <condition match="$click.name2$==&quot;component&quot; AND $row.sno$==&quot;2&quot;">
            <eval token="tokFirstColumnSecondRowClicked">case($row.sno$="2",$click.value2$)</eval>
            <!-- Debug Statements to capture Clicked Column and Row -->
            <set token="tokClickedRow">$row.sno$</set>
            <set token="tokClickedColumn">$click.name2$</set>
          </condition>
          <condition>
            <unset token="tokFirstColumnSecondRowClicked"></unset>
            <!-- Debug Statements to capture Clicked Column and Row -->
            <set token="tokClickedRow">$row.sno$</set>
            <set token="tokClickedColumn">$click.name2$</set>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Please try out and confirm!

Re: How do I create a drilldown for a specific cell location (not cell value) in a table?

nick405060 — Tue, 09 Oct 2018 17:50:49 GMT

I'm trying this (copied and pasted into a new dash) and unfortunately the conditional statement isn't ever being met in Splunk 6.3. Even if I change it to just be

<condition match="$row.sno$==&quot;2&quot;">

it isn't being recognized as a match.

Re: How do I create a drilldown for a specific cell location (not cell value) in a table?

nick405060 — Tue, 09 Oct 2018 18:21:04 GMT

Yup, $row.sno$ is being evaluated to 0 if inside a conditional statement, both the conditional statement on line 27 and the one on line 28. Outside a conditional statement it works (evaluates to 2), e.g.:

<set token="tokClickedRow">$row.sno$</set>

Re: How do I create a drilldown for a specific cell location (not cell value) in a table?

nick405060 — Tue, 09 Oct 2018 18:34:42 GMT

Solved.

https://answers.splunk.com/answers/542282/eval-token-expression-how-to-set-a-token-with-eval.html

In both conditional statements you need ' not $