Hi.
I made a drilldown dashboard and first field's value was sending to another view.
But first fields' value is too long , I just made a hidden colum for sending.
<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
<module name="SideviewUtils" layoutPanel="appHeader" />
<module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="True">
<module name="Search">
<param name="search">sourcetype=tms_syslog | stats sum(Count) as Count by EventName | join type=left EventName [SEARCH sourcetype=attack_type] | fields EventName Count ATTACK_NAME| eval Event_Name=if(len(EventName) >30 , substr(EventName,1,30)+"...", EventName) | fields EventName Event_Name Count ATTACK_NAME | rename Event_Name as "이벤트명" ATTACK_NAME as "공격유형" | sort - Count</param>
<param name="earliest">-1h</param>
<module name="JobProgressIndicator"></module>
<module name="SimpleResultsTable">
<param name="entityName">results</param>
<param name="drilldown">row</param>
<param name="displayRowNumbers">False</param>
<param name="count">100</param>
<module name="Redirector">
<param name="popup">true</param>
<param name="url">myView</param>
<param name="arg.event">$click.value$</param>
</module>
</module>
</module>
</module>
</view>
In this site, I found a answer that asked to apply an application.js
if(Splunk.util.getCurrentView() == "myview") {
Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
renderResults: function($super,data) {
$super(data);
$('td:nth-child(2),th:nth-child(2)', this.container).hide();
}
});
}
So, I'm now apply the application.js and solve the problem. But field's name is not hide. If the table have 4 fields (first field is hidden) , 4 fields name , 3 data fields ard displayed. Do you understand my question?
