Is there any way to pass the all the values of a column from 1st to 2nd panel?

[skjaki786]

this one didn't work

<done>
<condition match="$job.resultCount$==0">
<set token="Tokent">0</set>
</condition>
<condition>
<set token="Tokent">$row.device_ip_address.value$</set>
</condition>
</done>

below one is only giving 1st value of the field... I need to show rest of the values of device_ip_address

<done>
<condition match="$job.resultCount$==0">
<set token="Tokent">0</set>
</condition>
<condition>
<set token="Tokent">$result.device_ip_address$</set>
</condition>
</done>

[bowesmana]

The drilldown can't pass multiple rows of a table, but you could do this in a couple of ways

1. Create a stats values() of the column you want and just do not display it - using the <fields> XML element - it will still exist in every row as a field. Pass this field as a multi value field.

2. When you click the table, have a second search that uses the first search as a base search and runs and does the stats values(column) and another <done> clause to set the token.

[skjaki786]

Thanks for the reply. But I forgot to mention that both are having different indexes> I am not able to use base search here.

[bowesmana]

Yes, you can because the second search using the base is simply to create the single row result, which you can then turn into a token, e.g.

<search id="base">
  <query>
bla
  </query>
</search>

<table depends="$hidden$">
  <search base="base">
    <query>
| stats values(device_ip_address) as device_ip_address
| eval device_ip_address=mvjoin(device_ip_address, ",")
    </query>
  </search>
  <done>
    <set token="mytoken">$result.device_ip_address$</set>
  </done>
</table>

and then your other search can use $mytoken$ as needed - use the eval in the second search to make the format of the device_ip_address values what you need it to be for the other search.