Change source for only one column of a table, whil...

deruvara · ‎12-03-2021

Hi Thank you for al the response and glad this is helping me resolve issues while learning splunk 🙂

Appreciate your help.

1. how to change source for only one column in a table and filter/sort it based on other column?

Below i need to change source for mainline column and associate data to project column. also i need to filter and sort the data alphabetically.

<table>
<search>
<query>index="wtqlty" source=pdf-fc-002-rh sourcetype="release_pdf_results_json" | table pdf_name, pdf_state, main_line, Req_report, patch_name, started_on, Stream_start, Handover, planned_stopped_on, fco_state, snapshot, stakeholders.project_leader.name, stakeholders.developer.name, air_issues{}.short_description , Quality, questionnaire | rename pdf_name AS PDF, pdf_state AS "PDF State", main_line AS "Mainline", patch_name AS Project, started_on AS "PDF start", planned_stopped_on AS "Planned Stop", fco_state AS "FCO State", stakeholders.project_leader.name AS PL, stakeholders.developer.name AS Developer, air_issues{}.short_description AS Description, questionnaire AS Questionnaire</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="FCO State">
<colorPalette type="expression">case (match(value,"DRAFT_DEV"), "#DC4E41",match(value,"ACCEPTED"),"#53A051",true(),"#C3CBD4")</colorPalette>
</format>
<format type="color" field="PDF State">
<colorPalette type="expression">case (match(value,"DRAFT_DEV"), "#DC4E41",match(value,"accepted"),"#53A051",true(),"#C3CBD4")</colorPalette>
</format>
<drilldown>
<condition field="PDF State">
<set token="form.pdf_state_token">$click.value2$</set>
</condition>
<condition field="PL">
<set token="form.PL">$click.value2$</set>
</condition>
<condition field="FCO State">
<set token="form.fco_name">$click.value2$</set>
</condition>
<condition field="Developer">
<set token="form.developer">$click.value2$</set>
</condition>
<condition field="Snapshot">
<set token="form.snap_shot">$click.value2$</set>
</condition>
<condition field="Mainline">
<set token="form.main_line">$click.value2$</set>
<set token="form.show_clear_filter">*</set>
</condition>
<condition field="Project">
<set token="form.patch_name">>$click.value2$</set>
<link target="_blank">https://stream-dashboard.asml.com/db/overall/$click.value2$/</link>
</condition>
<condition field="PDF">
<set token="form.pdf_name">$click.value$</set>
<link target="_blank">https://at.patchtooling.asml.com/pdf/RH/ML/patches/$row.Project$/</link>
</condition>

2.how to change format of text, inside a cell? say if there is an URL for the text in a cell, i need to underline it, so users knows its url link clickable?

3. how can we strike a number based in cell and update with new number(in case of weeks)

Appreciate your help. thank you

ITWhisperer · ‎12-04-2021

The table will show the results of a search query, so construct the search query to have the data from both sources, perhaps using a join or stats command to collate the events from the different sources into events with common field values
Use the drilldown method shown in the response to your previous question
You can use some CSS to line-through multi-value lines

    <panel depends="$stayhidden$">
      <html>
        <style>
          #id-of-panel div.multivalue-subcell {
            text-decoration: line-through !important;
          }
          #id-of-panel div.multivalue-subcell[data-mv-index="0"] {
            text-decoration: none !important;
          }
        </style>
      </html>
    </panel>

Change source for only one column of a table, while all the columns of table uses some another source

CSS

drilldown

panel

table

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?