All Apps and Add-ons

How to pass more than one column as search terms in Gate Module table drill down - Sideview Utils

pradeepkumarg
Influencer

I have a SimpleResultsTable with the below query in my Advancedxml

index=myindex sourcetype=mysourcetype | search FILE_ID="xyz" | table fieldA, fieldB, fieldC, fieldD, fieldE, fieldF

Im using a gate module to drill down to a different table on selecting a row. Below is my drilldown query on gate target module

index=myindex sourcetype=mysourcetype $row.searchTerms$ | search FILE_ID="xyz" | table fieldG, fieldH, fieldI, fieldJ

Now the $row.searchTerms$ gets only fieldA, how can I pass fieldB & fieldC along with fieldA ?

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You should be able to access those field values through $row.fields.fieldB$, $row.fields.fieldC$, etc.

Have you considered using Sideview's Table module rather than the SimpleResultsTable module?

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You should be able to access those field values through $row.fields.fieldB$, $row.fields.fieldC$, etc.

Have you considered using Sideview's Table module rather than the SimpleResultsTable module?

pradeepkumarg
Influencer

$click.fields.fieldB$ worked for SimpleResultsTable. Thanks again!

martin_mueller
SplunkTrust
SplunkTrust

That's possible, it's been too long though since I used SimpleResultsTable... just try it out 😛

0 Karma

pradeepkumarg
Influencer

Thanks Martin, Will I be able to use $row.fields.fieldB$, $row.fields.fieldC$ only through Sideview's Table module?

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...