How to change the search based on a clicked table value?

canar40 — Tue, 29 Sep 2020 09:45:32 GMT

Newbie here so please bear with me 🙂
I created a table using stats count with 3 columns.

What I also did is to dynamically change the search to search on what I clicked. Afterwards, I use timechart count to display the results based on the opposite, e.g. if I click on a 10653_10_99, the time chart would be by "Bag verloren geraakt". The code:

index=wincc Type=2 Text1="Backbone"  State=3 |
rename Text5 as CI |  rename Text6 as Omschrijving |
search $columnName2$ = "$columnPicker2$" |
eval sortByTheOpposite = case("$columnName2$"=="Omschrijving",CI,"$columnName2$"=="CI", Omschrijving) |
timechart count by sortByTheOpposite useother=f limit=10

This works if I click on one of the first two columns. Now I want to dynamically change my search/time chart if I click on a value in the third column. This would require a string of type "search CI = "XX" AND Omschrijving = "YY" "
For this, I was planning to use click.name and row.Omschrijving and get the XX and YY values, however I cannot incorporate in the case the brackets. Any ideas of a work around? Thank you very much in advance!

Re: How to change the search based on a clicked table value?

canar40 — Wed, 08 Jun 2016 13:26:42 GMT

For those interested, we fixed it this way:

<drilldown>
    <condition field="CI">
    <set token="columnName1">$click.name2$</set>
    <set token="valueName1">$click.value2$</set>
    </condition>
</drilldown>

Then you create a panel depending on a certain token:

<panel depends="valueName1">
</panel>

topic How to change the search based on a clicked table value? in Splunk Search

How to change the search based on a clicked table value?

Re: How to change the search based on a clicked table value?