Hi Splunk Guru's ,
i am a new bee to splunk, i am trying to access all the results for a tables to be used as variables in other search in the same dashboard. the token $result.filed$ when used with event handler give me just the first result from the search table(ABCD),
how do i access all the results of the table from the search. example how do i access "EFGH"
Site_name temp_on_site
ABCD 84.5
EFGH 80.63
Hi, are you saying that you want to click on the first row, and then have Site_name=ABCD and temp_on_site=84.5 to be used as fields in another search?
Then are you also saying that when the user clicks on the second row of that table, then likewise Site_name=EFGH and temp_on_site=80.63 will be used?
If so, then inside your XML you should have something like this:
<option name="drilldown">row</option>
<drilldown>
<set token="siteTok">$row.Site_name$</set>
<set token="forms.siteTok">$row.Site_name$</set>
<set token="tempTok">$row.temp_on_site$</set>
<set token="forms.tempTok">$row.temp_on_site$</set>
</drilldown>
Then your receiving table would use $siteTok$ and $tempTok$ in the SPL.