All Apps and Add-ons

How to get field value and post it in link (Dashboard)?

sbimizry
Engager

Hi, from search ...| timechart count by status maked spikes diagram in dashboard.
Example output search:
_time 200 300 400
08/09/19 5 8 4
08/07/19 1 3 7

How to get status name (200, 300, 400) and set it in link...

<drilldown>
  <link>/apps/dashboard?form.field=$click.statusname$</link>
</drilldown>

Note:

row not worked, only all or none
$click.name$ - return field name '_time'
$click.name2$ - return field name 'count'
$click.value$ - return value field _time
$click.value$ - return value field count
0 Karma

woodcock
Esteemed Legend

You are not making sense. I used this run-anywhere search:

index=_* sourcetype=*access
|  timechart count BY status

And saved it as a dashboard panel with the Line chart visualization.
When I clicked Edit -> -> Edit drilldown and set On click to Link to search and Auto, It correctly used status=$click.name2$ as the drilldown search segment. Futhermore, if changed from Auto to Custom and used this drilldown search:

| makeresults 
| eval name="$click.name$", value="$click.value$", name2="$click.name2$", value2="$click.value2$"

I get this:

| makeresults | eval name="_time", value="1565974800.000", name2="200", value2="1014"

Which also confirms that the correct token is $click.name2$. This absolutely, positively, unquestionably IS the right answer.

0 Karma

niketn
Legend

@sbimizry try predefined drilldown token $click.name2$ as per the documentation.

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#Predefined_dr...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sbimizry
Engager

I diding it, not worked...
$click.name2$ - return field name 'count'
$click.name$ - return field name '_time'
$click.value$ - return field value '10/08/19 16:25' (one word - time)
$click.value$ - return field value count (5, 8, 4 etc)
Maybe there are other ideas?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...