Good morning,
I am trying to build a drill down off one dashboard panel to build a search in the second. The issue i am running into is am passing a value of pf\first.last but in the new search, it needs to pass as pf\first.last (notice the extra escape \ character). Does anyone know how i might do this? My current search is: (where $user.user$) is a drill down set value option from a corresponding panel.
eventtype="pan_url" dest_zone="L3-Untrust" src_user=$user.user$ (app=adobe-connect OR app=brighttalk OR app=citrix OR app=citrix-jedi OR app=clearspace OR app=globalmeet-base OR app=gotomeeting OR app=gotowebinar-base OR app=hp-virtual-rooms OR app=jabber OR app=join-me OR app=live-meeting OR app=meetup OR app=skype OR app=tigertext OR app=webex OR app=zendesk OR app=zoom OR app=teamviewer-base)| stats count by app | sort - count
Any help is greatly apprecated.
Thank you for that. I am trying to use the edit drill down so not sure how I would implement that in the first panel to feed to the second. Here is a screenshot in case it proves helpful.
Got It! Thank you. Worked like a champ!
In the first panel, you are taking the value from one field, adding a second slash to the value in that field, and putting it into the token user.name
. Let's say the field in the first panel is called name_field
. Then in the dropdown you show above, you'd change "Set" to "Eval", leave "user.user" in the first text entry box, and put this into the second:
mvjoin(split($row.name_field$, "\\"), "\\\\")
That should take the value from name_field
in the first panel, add a second slash, and put it all into the user.user
token.
How about using an eval to add a second slash before passing it to the other dashboard? Here's a sample:
| makeresults
| eval a="pf\something"
| eval b=mvjoin(split(a, "\\"), "\\\\")
This guide documents how to use <eval>
elements to modify values being passed in a drilldown:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting