How do I use a value from a different field in drilldown?

[ZacEsa]

Right now, when I click on the value in column two, I can use the values in column one and two with $click.value$ and $click.value2$. However, if I click on the value in column one, I can only use the value in column one with $click.value$. $click.value2$ basically becomes the same as $click.value$.

Example;
If I click on {row_one, column_two}, $cell.value$ = 1 and $cell.value2$ = 3
If I click on {row_one, column_one}, $cell.value$ = 1 and $cell.value2$ = 1

So, how do I use the value of {row_one, column_two} even if only {row_one, column_one} is clicked?

[niketn]

@ZacEsa you can always use $row.column_one$,$row.column_two$, $row.column_three$... to fetch value from any column from the row where a particular cell is clicked. $click.value$ is for first column in the table and $click.value2$ is for current cell.

Refer to Splunk Documentation : https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#Drilldown_event_tokens

[harsmarvania57 · Accepted solution]

Hi @ZacEsa,

In drilldown, $click.value$ is value of the first cell in row however $click.value2$ is actual clicked cell value.

For example
If you click on row_one, column_three it will give you $click.value$=1 and $click.value2$=5
If you click on row_two, column_four it will give you $click.value$=2 and $click.value2$=8

If you would like to use 2nd column value from every row in drilldown then you can use $row.column_two$

So based your data when you click anywhere in first row it will give you $row.column_two$=3 and in 2nd row it will give you $row.column_two$=4

[niketn]

Guess I was late 🙂

[ZacEsa]

Actually, I tried with the row but, my column name is like, Device Name: so, when I tried $row.Device Name:$, it didn’t work. Is there any special format or I can’t rename it as such if I want to use the drill down?

[harsmarvania57]

I suggest to rename column name in main query | rename "Device Name:" as Device_Name and then use $row.Device_Name$ in drilldown.

[ZacEsa]

I actually renamed it to "Device Name:" so that it looks nicer on the dashboard. So, I can't use a nice name if I want to use a custom drilldown?

[harsmarvania57]

I don't know how to use : in token but if you can use Device Name instead of Device Name: for column header then try $row.Device Name$

[ZacEsa]

Hadn't tried it but I'll accept your answer and use Device_Name for now. Thanks!

[harsmarvania57]

lol ....:)

[ZacEsa]

Okay, I didn't test it out before but strangely, if I click on {row_one, column_three}, then $cell.value2$ = 5.