topic Re: Click Selection not working. in Splunk Search

Click Selection not working.

jerinvarghese — Tue, 28 Dec 2021 14:38:01 GMT

Hi All,

I have a code, that uses the output to fetch data from another Panel.

First Panel

<title>Juniper Mnemonics</title> <table> <search> <query>index=nw_syslog | search hostname="*DCN*" | stats count by cisco_mnemonic, hostname | sort - count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <drilldown> <condition field="cisco_mnemonic"> <set token="message_token">$click.value$</set> </condition> <condition field="hostname"> <set token="hostname_token">$click.value$</set> </condition> <condition field="count"></condition> </drilldown> </table>

From this panel 2 contents are fetched for second panel search.

Second Panel

Issue:

When ever i click the first panel table.( given ROW as Click Selection). its not getting fetching correctly.

Only fetching "cisco_mnemonic" only for both cisco_mnemonic and hostname. Please guide me how can i get both in single click.

Re: Click Selection not working.

richgalloway — Tue, 28 Dec 2021 15:44:25 GMT

I think the root cause of the problem is setting each token to the same value ($click.value$). Have you tried something like this?

<drilldown> <condition field="cisco_mnemonic"> <set token="message_token">$row.cisco_mnemonic$</set> </condition> <condition field="hostname"> <set token="hostname_token">$row.hostname$</set> </condition> <condition field="count"></condition> </drilldown>

Re: Click Selection not working.

ashvinpandey — Wed, 29 Dec 2021 06:12:17 GMT

@jerinvarghese Change your drilldown tag in the first panel as shown below:

<drilldown> <set token="message_token">$row.cisco_mnemonic$</set> <set token="hostname_token">$row.hostname$</set> </drilldown>

If this didn't work you must also try the solution given by @richgalloway
Also if this reply helped you in solving your problem, an up-vote would be appreciated.