How can I drilldown values from a hidden field?

[pamcarvalho]

Hey!

I am building a dashboard and this problem is being a headache. I really need to find a way to drilldown values from hidden fields and/or panels, but not sure how to do so.. Can anyone help me, please?
Thanks in advance!

[jeffland · Accepted solution]

Based on your comments, what you might be looking for is something like this:

<table>
  <search>
    <query>data=A | table info date</query>
  </search>
  <drilldown>
    <eval token="drilldown_token">strftime(strptime('row.date', "%F"), "%d.%m.%Y")</eval>
  </drilldown>
</table>
...
<table depends="$drilldown_token$">
  <search>
    <query>data=B | search other_date="$drilldown_token$"</query>
  </search>
</table>

This allows you to have a value passed to the drilldown that is not visible in the table you drilled down from. In the case above, imagine having a date like "2017-10-19" in the table you drill down from while you need it as "19.10.2017" in your target search.

[pamcarvalho]

Yes!!!! That's it! Thank you very much!

[pamcarvalho]

Just an update, this wasn't working for me but I found a way to do it, so in case that helps anyone, this is what I did:

<drilldown>
          <eval token="EOEDDE">strftime('earliest',"%d/%m/%y")</eval>
          <eval token="EOEDDL">strftime('latest',"%d/%m/%y")</eval>
          <set token="EOEDD">$earliest$</set>
          <set token="EOLDD">$latest$</set>
</drilldown>

I used "EOEDDE" and "EOEDDL" for the panel title. "EOEDD" and "EOLDD" to generate results to a table.

[gcusello]

Hi pamcarvalho,
create your search, e.g.:

index=my_index
| table _time field1 field2 hidden_field

in the panel options put the tag

<fields>_time,field1,field2</fields>

then in drilldown you can use hidden_field

Bye.
Giuseppe

[pamcarvalho]

But that only works assuming that someone clicks on the table right? Is there a way do display the field value without depending on that?

[pamcarvalho]

For example, a hidden panel that has a table with only one field value. Is it possible to drilldown this value?

[gcusello]

a drilldown starts always from a click on a Splunk object!
Do you want to automatically open a dashboard from another one?
Why?
bye.
Giuseppe

[pamcarvalho]

No, l want to drilldown a value, change its format and then drilldown the new value. But the intermediary value shouldn't show up.. Not sure if I made myself clear..