topic Re: How add stats table to each row in a stats table in Splunk Search

How add stats table to each row in a stats table

rkishoreqa — Sat, 12 Dec 2020 16:55:33 GMT

I built a dashboard to view the stats count of applications with the below query.

Query : index="bw6_stg" ErrorReport| rex field=_raw "ApplicationName:\s+\[(?P<Applname>.*)];" | rex field=_raw "jobId: (?<jId>\w+);" |dedup jId |stats count by Applname

For the above query below are the results.

Applname Error count
abcd 5
abcd.app 6
efgh 4
efgh.app 3

Now my requirement is to add stats count of errors for each application this stats table like as below.
When I click on the 1st application, it should show us like below.

Applname Error count
abcd 5
Error1 2
Error2 1
Error3 2

When I click on the 2nd application, it should show us like below.

Applname Error count
abcd .app 6
Error1 2
Error2 2
Error3 2

can you anyone please help me on this, Thanks in advance

Re: How add stats table to each row in a stats table

nickhills — Mon, 14 Dec 2020 11:25:34 GMT

Is your question:

"what should the search string be for the second panel?"

or is it:

"how do i make a click in one panel affect the contents of another panel?"

If you want to know how to make another panel appear and be driven by the click see this answer:

https://community.splunk.com/t5/Splunk-Search/Can-you-display-a-panel-only-if-the-user-clicks-on-one-specific/m-p/402712

Re: How add stats table to each row in a stats table

rkishoreqa — Mon, 14 Dec 2020 19:22:38 GMT

My requirement is to display stats count table on ApplicationName and when I clicked on the ApplicationName it should display Errors count as stats count table.

Applname Error count
abcd 5
Error1 2
Error2 1
Error3 2

abcd .app 6
Error1 2
Error2 2
Error3 2

Re: How add stats table to each row in a stats table

rkishoreqa — Mon, 14 Dec 2020 19:33:22 GMT

The second panel needs to get application name from 1st panel, what we selected.

Re: How to add stats table to each row in a stats table

rkishoreqa — Mon, 14 Dec 2020 20:01:41 GMT

The second panel needs to get application name from 1st panel, what we selected.

My requirement is to display stats count table on ApplicationName and when I clicked on the ApplicationName it should display Errors count as stats count table.

Applname Error count
abcd 5
Error1 2
Error2 1
Error3 2

abcd .app 6
Error1 2
Error2 2
Error3 2

Re: How add stats table to each row in a stats table

nickhills — Mon, 14 Dec 2020 21:03:14 GMT

Use $row.<fieldname>$ in your drilldown.

In your case that is probably something like $row.ApplName$

See https://docs.splunk.com/Documentation/Splunk/8.1.0/Viz/PanelreferenceforSimplifiedXML#Predefined_drilldown_tokens