I have a table that contains some columns.
My requirement was to open a URL on clicking the column value which i did but now i want to make those values clickable.
Please suggest
I have provided the drill down part below
<link>
<![CDATA[Respective link ]]>
</link>
</drilldown>
Thanks in advance
If you are attempting to do it through simple xml:
SimpifedXMLDrilldown on Splunk Docs
On that Page Scroll down to the Predefined Drilldown Tokens section, then look under the Table subsection. Here are the options I believe you may be looking for EG:
**table**
**Token**
Description
$click.name$ Leftmost field (column) name in the table. Typically, _time is leftmost in a table that includes this field and where columns are ordered by default.
$click.value$ Leftmost field (column) value in the clicked table row.
$click.name2$ Clicked field (column) name. In a <condition> element configuring drilldown in a table, field corresponds to $click.name2$.
$click.value2$ Clicked field (column) value. Use this token to capture the specific table cell value that users click.
$row.<fieldname>$ Access any field (column) value from the clicked table row.
$earliest$ Earliest time for the clicked table row. If not applicable, uses the earliest time of the search.
$latest$ Latest time for the clicked table row. If not applicable, uses the latest time of the search.
An Example in dashboard usage:
Example
A click on the table sets a token which is consumed by the search of the chart visualization.
<dashboard>
<label>In-page Drilldown</label>
<row>
<panel>
<table>
<title>Set sourcetype token on click</title>
<search>
<query>
index=_internal | stats count by sourcetype
</query>
<earliest>-1h</earliest>
<latest>now</latest>
</search>
<drilldown>
<condition field="sourcetype">
<set token="sourcetype">$click.value2$</set>
</condition>
</drilldown>
</table>
<chart>
<title>Chart for $sourcetype$</title>
<search>
<query>
index=_internal sourcetype=$sourcetype$ | timechart count by sourcetype
</query>
<earliest>-1h</earliest>
<latest>now</latest>
</search>
</chart>
</panel>
</row>
</dashboard>
So as for what you are looking for, assuming you want the clicked value to be part of the link:
<table>
<search>index=_internal</search>
<!-- Pass the clicked cell's value, earliest time, -->
<!-- and latest time to a destination form's -->
<!-- token ('foo') and search parameters -->
<drilldown>
<link>
<![CDATA[
/app/search/simple_xml_form?form.foo=$click.value2$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>
</table>
You can find many more examples in the drilldown section of the link above.
Change the format of the display through UI to click selection as "CELL", and use following tokens to send those name value pairs to destination link.
dirldownlink?$click.name2$=$click.value2$
if you have Splunk 7 you could do it throught the GUI:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Drilldownonstatisticaltablerowsandcells
so you want both the column name and the clicked value passed through?
before there is