<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: how to set token from a table in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243963#M72597</link>
    <description>&lt;P&gt;Hi, Did you ever figure this out?&lt;/P&gt;</description>
    <pubDate>Mon, 18 Dec 2017 17:03:49 GMT</pubDate>
    <dc:creator>rohansecadvbot</dc:creator>
    <dc:date>2017-12-18T17:03:49Z</dc:date>
    <item>
      <title>how to set token from a table</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243958#M72592</link>
      <description>&lt;P&gt;Hi&lt;BR /&gt;
suppose search result:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;col1  col2
1       2
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;then&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;preview&amp;gt;
&amp;lt;set token="row1_col2"&amp;gt;$result.col2$&amp;lt;/set&amp;gt;
&amp;lt;/preview&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;will set value "2" for "$row1_col2$"&lt;/P&gt;

&lt;P&gt;but if search result as:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    col1  col2
    1       2
    3       4
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;how could i get the value of "row2_col2" ?&lt;/P&gt;</description>
      <pubDate>Thu, 21 Jan 2016 09:18:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243958#M72592</guid>
      <dc:creator>crazyeva</dc:creator>
      <dc:date>2016-01-21T09:18:47Z</dc:date>
    </item>
    <item>
      <title>Re: how to set token from a table</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243959#M72593</link>
      <description>&lt;P&gt;hi can you send your xml code please&lt;/P&gt;</description>
      <pubDate>Thu, 21 Jan 2016 11:49:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243959#M72593</guid>
      <dc:creator>chimell</dc:creator>
      <dc:date>2016-01-21T11:49:07Z</dc:date>
    </item>
    <item>
      <title>Re: how to set token from a table</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243960#M72594</link>
      <description>&lt;PRE&gt;&lt;CODE&gt;&amp;lt;form&amp;gt;
  &amp;lt;panel&amp;gt;
    &amp;lt;search ref="a savedsearch"&amp;gt;
      &amp;lt;preview&amp;gt;
        &amp;lt;set token="value"&amp;gt;$result.count$&amp;lt;/set&amp;gt;
      &amp;lt;/preview&amp;gt;
    &amp;lt;/search&amp;gt;
    &amp;lt;html&amp;gt;
      &amp;lt;h1&amp;gt;$value$&amp;lt;/h1&amp;gt;
    &amp;lt;/html&amp;gt;
  &amp;lt;/panel&amp;gt;
&amp;lt;/form&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Xml code a bit complicate and structure like above&lt;/P&gt;</description>
      <pubDate>Thu, 21 Jan 2016 12:26:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243960#M72594</guid>
      <dc:creator>crazyeva</dc:creator>
      <dc:date>2016-01-21T12:26:47Z</dc:date>
    </item>
    <item>
      <title>Re: how to set token from a table</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243961#M72595</link>
      <description>&lt;P&gt;In a table drill down, by default you have &lt;CODE&gt;row.fieldname&lt;/CODE&gt; as a token&lt;/P&gt;

&lt;P&gt;In your case , you when you click on the second row, you have row2_col2 value in &lt;STRONG&gt;row.col2&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;click.name  Name of the leftmost field that is displayed in the table. This is always _time, if present.
click.value Value of the left-most column in the clicked row.
click.name2 Name of the clicked column.
click.value2    Value of the clicked column.
row.&amp;lt;fieldname&amp;gt; All field values for the clicked table row, including those fields that are not displayed.
earliest/latest Time range of the clicked table row, or if not applicable, the time range of the search.
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event_tokens"&gt;http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/PanelreferenceforSimplifiedXML#Drilldown_event_tokens&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 21 Jan 2016 12:30:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243961#M72595</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2016-01-21T12:30:31Z</dc:date>
    </item>
    <item>
      <title>Re: how to set token from a table</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243962#M72596</link>
      <description>&lt;P&gt;thank you&lt;BR /&gt;
still a lot to learn from 'Simple XML Reference'&lt;BR /&gt;
but my issue is not about a drilldown search. it's just html display style. there will be no 'click' to set tokens&lt;BR /&gt;
the result table will not appear.&lt;BR /&gt;
values just shows in html as:&lt;BR /&gt;
&lt;CODE&gt;hello, a demo~&lt;/CODE&gt;&lt;BR /&gt;
&lt;CODE&gt;value_of_row1_col1&lt;/CODE&gt;&lt;BR /&gt;
&lt;CODE&gt;value_of_row1_col2&lt;/CODE&gt;&lt;BR /&gt;
&lt;CODE&gt;value_of_row2_col1&lt;/CODE&gt;&lt;BR /&gt;
&lt;CODE&gt;value_of_row2_col2&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 22 Jan 2016 01:29:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243962#M72596</guid>
      <dc:creator>crazyeva</dc:creator>
      <dc:date>2016-01-22T01:29:03Z</dc:date>
    </item>
    <item>
      <title>Re: how to set token from a table</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243963#M72597</link>
      <description>&lt;P&gt;Hi, Did you ever figure this out?&lt;/P&gt;</description>
      <pubDate>Mon, 18 Dec 2017 17:03:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243963#M72597</guid>
      <dc:creator>rohansecadvbot</dc:creator>
      <dc:date>2017-12-18T17:03:49Z</dc:date>
    </item>
    <item>
      <title>Re: how to set token from a table</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243964#M72598</link>
      <description>&lt;P&gt;Hi, seems not yet. I almost forget about this.&lt;/P&gt;</description>
      <pubDate>Tue, 19 Dec 2017 03:40:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243964#M72598</guid>
      <dc:creator>crazyeva</dc:creator>
      <dc:date>2017-12-19T03:40:08Z</dc:date>
    </item>
    <item>
      <title>Re: how to set token from a table</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243965#M72599</link>
      <description>&lt;P&gt;Hi, did you found a solution?&lt;/P&gt;</description>
      <pubDate>Thu, 11 Apr 2019 19:46:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-token-from-a-table/m-p/243965#M72599</guid>
      <dc:creator>carlosdesousa91</dc:creator>
      <dc:date>2019-04-11T19:46:07Z</dc:date>
    </item>
  </channel>
</rss>

