topic Re: How to display fields that have a common value in a table? in Splunk Search

How to display fields that have a common value in a table?

clairebesson — Tue, 08 Sep 2015 15:37:47 GMT

Hi everyone,

I have a file with serial numbers and purchase order numbers.

In a first table, I display a serial number and the corresponding purchase order. This table is the result of a drilldown. The user has clicked on a serial number on another page. The new page got the serial_token in an text input and displays the result in a table (serial number and purchase order number).

On the same page, in a second table, I want to display all the serial numbers that have the same purchase order as my first table.
I have no idea on how I can do the second table. Could you please help me with that?
Thanks,

Re: How to display fields that have a common value in a table?

frobinson_splun — Tue, 29 Sep 2020 07:11:01 GMT

Hi @clairebesson,
I'm a tech writer here at Splunk and I'd like to help with your question. I'm not 100% sure of the workflow you're describing here. It sounds like this to me:
1) text input for serial number captures serial_token
2) serial_token is passed to a page that displays serial numbers
3) user clicks on a serial number to drill down
4) drilldown displays a serial number + purchase order number in a table
And you'd like to add this:
5) another panel shows all serial numbers connected to the purchase order from the previous step.

I think what might work is to capture the purchase order in a token somewhere between step 3 and 4 here. Use that purchase order value in a search over your full data set that then generates the new (2nd) table showing all serial numbers that match the purchase order.

I would suggest taking a look at this documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Dynamicdrilldownindashboardsandforms
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/tokens
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/TokenReference

I hope this helps! Let me know either way and we can continue discussing.

All the best,
@frobinson_splunk

Re: How to display fields that have a common value in a table?

clairebesson — Tue, 08 Sep 2015 18:49:38 GMT

Hi, thanks for your answer.
1) First dashboard:
- User clicks on serial number and go to other dashboard (second dashboard)
2) Second Dashboard:
- text input captures serial_token
- Table 1: Serial Number selected and PO
- Table 2: all serial numbers connected to the purchase order

I created a second text input to capture po_token:

<link target="Serial">/app/search/serialdetails?form.serial_number_token=$click.value2$&amp;form.po_token=$row.po_token$  </link>

But it didn't work... I don't know how to capture the PO value when I click on Serial Number...

Re: How to display fields that have a common value in a table?

somesoni2 — Tue, 08 Sep 2015 18:53:56 GMT

You would have to change the drilldown=cell to drilldown=row in your first table and change

/app/search/serialdetails?form.serial_number_token=$click.value2$&amp;form.po_token=$row.po_token$

/app/search/serialdetails?form.serial_number_token=$row.Serial Number$&amp;form.po_token=$row.PO$

Re: How to display fields that have a common value in a table?

clairebesson — Tue, 08 Sep 2015 19:06:37 GMT

Thank you very much. It works perfectly !

Re: How to display fields that have a common value in a table?

clairebesson — Tue, 29 Sep 2020 07:14:08 GMT

thanks @somesoni2 it works perfectly.
If I add a third table from another source (source 2), is it possible to capture a value in this table?
Here is the query for the third table :
source="source2.csv" "Serial Number"=$serial_number_token$ “Location”=”*”>
It displays a table with the location of the serial number selected.
Is it possible to create another table that display all Serial Number in the same location (without click on the location value)?
I tried to add $row.Location$

Re: How to display fields that have a common value in a table?

somesoni2 — Tue, 29 Sep 2020 07:11:09 GMT

Same location as currently selected serial_number (token value $serial_number_token$) OR All location and all serial number?

Re: How to display fields that have a common value in a table?

clairebesson — Tue, 29 Sep 2020 07:11:14 GMT

@somesoni2 same location as currently selected serial_number (serial_number_token)

Re: How to display fields that have a common value in a table?

clairebesson — Fri, 11 Sep 2015 21:03:28 GMT

@somesoni2 any idea ?
I was thinking to do that in the search: "For a specific serial number, find other that have the same location as serial number selected" ...

Re: How to display fields that have a common value in a table?

somesoni2 — Fri, 11 Sep 2015 21:40:58 GMT

You can probably use subsearch to add location filter. Something like this (the subsearch get the location of selected Serial Number and add as filter to main search)

source="source2.csv"  [search source="source2.csv" source="source2.csv" "Serial Number"=$serial_number_token$ | table Location ] | table "Serial Number" Location

Re: How to display fields that have a common value in a table?

clairebesson — Mon, 14 Sep 2015 13:09:28 GMT

thanks a lot !