All Apps and Add-ons

How to pass more than one column as search terms in Gate Module table drill down - Sideview Utils

pradeepkumarg
Influencer

I have a SimpleResultsTable with the below query in my Advancedxml

index=myindex sourcetype=mysourcetype | search FILE_ID="xyz" | table fieldA, fieldB, fieldC, fieldD, fieldE, fieldF

Im using a gate module to drill down to a different table on selecting a row. Below is my drilldown query on gate target module

index=myindex sourcetype=mysourcetype $row.searchTerms$ | search FILE_ID="xyz" | table fieldG, fieldH, fieldI, fieldJ

Now the $row.searchTerms$ gets only fieldA, how can I pass fieldB & fieldC along with fieldA ?

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You should be able to access those field values through $row.fields.fieldB$, $row.fields.fieldC$, etc.

Have you considered using Sideview's Table module rather than the SimpleResultsTable module?

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You should be able to access those field values through $row.fields.fieldB$, $row.fields.fieldC$, etc.

Have you considered using Sideview's Table module rather than the SimpleResultsTable module?

pradeepkumarg
Influencer

$click.fields.fieldB$ worked for SimpleResultsTable. Thanks again!

martin_mueller
SplunkTrust
SplunkTrust

That's possible, it's been too long though since I used SimpleResultsTable... just try it out 😛

0 Karma

pradeepkumarg
Influencer

Thanks Martin, Will I be able to use $row.fields.fieldB$, $row.fields.fieldC$ only through Sideview's Table module?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...