How do I get an additional event based on the result of a drilldown?

[damucka]

Hello,

I have the following drilldown in one of my panels:

    <drilldown>
      <eval token="earliesttime">$click.value$-0.003</eval>
      <eval token="latesttime">$click.value$+0.001</eval>
      <link target="_blank">search?q=index=mlbso sourcetype=$SYSID$_hanatraces  csns.admin.AdminConnection OR csns.admin.commands OR "ALTER SYSTEM ALTER CONFIGURATION" OR "ApplicationName=hdbsql"earliest=$earliesttime$ latest=$latesttime$</link>
    </drilldown>

The idea is that I search for the configuration change, which always has the string "ALTER SYSTEM ALTER CONFIGURATION" and also I need the event before where the executing user is logged — for that I search with the other three strings and restrict the time accordingly. Unfortunately, it does not work that well. The original parameter changing event looks as follows:

[84224]{206143}[1800/24537185288] 2018-11-23 14:28:33.867706 i SQLSessionCmd    Statement.cc(07130) : INI configuration is changed by 206143, client ip =##.##.##.##, client port=28660, query=alter system alter configuration('indexserver.ini','SYSTEM') set ('joins','adjust_fixed_result_length') = 'false' with reconfigure

I would like to change the drilldown in a way that it takes the number after the "changed by", in this case 206143 and searches with this for the event within the $earliesttime$ and $latesttime$ time span. So basically, the first drilldown event, which I identify with the string "ALTER SYSTEM ALTER CONFIGURATION" should be scanned for the session ID (number after the "changed by") and this session ID should be used to identify the second event.

How would I do this?

Kind Regards,
Kamil

[damucka · Accepted solution]

Hello,

I got the answer in another thread about sub-search.
The correct drilldown search looks as follows:

<link target="_blank">    <![CDATA[search?q=index=mlbso sourcetype=$SYSID$_hanatraces earliest=$earliesttime$ latest=$latesttime$ [search index=mlbso sourcetype=$SYSID$_hanatraces  "ALTER SYSTEM ALTER CONFIGURATION" earliest=$earliesttime$ latest=$latesttime$ | rex field=_raw "(%3Fi)(%3F<=configuration is changed by )(%3FP<CONNECTION_ID>(%3Fs)(.*))(%3F=, client ip)" | return $CONNECTION_ID]]]></link>

Kind Regrds,
Kamil