create your search, e.g.:
index=my_index | table _time field1 field2 hidden_field
in the panel options put the tag
then in drilldown you can use hidden_field
But that only works assuming that someone clicks on the table right? Is there a way do display the field value without depending on that?
For example, a hidden panel that has a table with only one field value. Is it possible to drilldown this value?
a drilldown starts always from a click on a Splunk object!
Do you want to automatically open a dashboard from another one?
No, l want to drilldown a value, change its format and then drilldown the new value. But the intermediary value shouldn't show up.. Not sure if I made myself clear..
Based on your comments, what you might be looking for is something like this:
<table> <search> <query>data=A | table info date</query> </search> <drilldown> <eval token="drilldown_token">strftime(strptime('row.date', "%F"), "%d.%m.%Y")</eval> </drilldown> </table> ... <table depends="$drilldown_token$"> <search> <query>data=B | search other_date="$drilldown_token$"</query> </search> </table>
This allows you to have a value passed to the drilldown that is not visible in the table you drilled down from. In the case above, imagine having a date like "2017-10-19" in the table you drill down from while you need it as "19.10.2017" in your target search.
Just an update, this wasn't working for me but I found a way to do it, so in case that helps anyone, this is what I did:
<drilldown> <eval token="EOEDDE">strftime('earliest',"%d/%m/%y")</eval> <eval token="EOEDDL">strftime('latest',"%d/%m/%y")</eval> <set token="EOEDD">$earliest$</set> <set token="EOLDD">$latest$</set> </drilldown>
I used "EOEDDE" and "EOEDDL" for the panel title. "EOEDD" and "EOLDD" to generate results to a table.