Archive

drilldown of the values

splunkpoornima
Communicator

I got the following output by using the below code...

index values(sources)

main c://taskmanager/taskmanager_log

list continues....

<?xml version='1.0' encoding='utf-8'?>

index=*|chart values(source) by index /app/search/flashtimeline?q=values(source)=$row.source$|transaction TaskBP startswith=START endswith=Succeeded|table TaskBP Duration

My requirement is if click the specific source i want see the query in the search ber as

index="main" source="c://taskmanager/taskmanager_log"|transaction TaskAction startswith=START endswith=Succeeded|

plz verify the code..and give suggestion

Tags (1)
0 Karma

Leo
Splunk Employee
Splunk Employee

try this:
...
index=|chart values(source) **as source* by index

/app/search/flashtimeline?q=index=$row.index$ source=$row.source$|transaction TaskBP startswith=START endswith=Succeeded|table TaskBP Duration
...

0 Karma

Leo
Splunk Employee
Splunk Employee

Also, note that this will only work on Splunk 5.0
If you're on an older version, you should use advanced xml drilldown.

0 Karma