Dashboards & Visualizations

How to combine two tables and make the drilldown work as normal?

bkumarm
Contributor

I have two tables that are generated out of queries as below:

Search1:

eventtype="Myown" source="*File1*" | dedup ID| eval A1=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | eval S1=if(A1="Pass", "Pass", "Fail") | transaction ID keepevicted=t | table _time, ID,  Error, S1,  A1

Search2:

eventtype="Myown" source="*File2*"  |  dedup ID | eval S2=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | transaction ID keepevicted=t | table _time, ID,  Error,  S2

These two searches generate tables and behave as expected.
Next I am combining them into one using append as below:

eventtype="Myown" source="*File1*" | dedup ID| eval A1=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | eval S1=if(A1="Pass", "Pass", "Fail") |  append [search eventtype="Myown" source="*File2*"  |  dedup ID | eval S2=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg] | transaction ID keepevicted=t | table _time, ID,  Error,  S2

The table comes up correctly and the values are shown properly.
When I click on any cell, that provides me drill down to the log entry properly.
However, at this point when I click Actions and show source, it is throwing an error and does not display the source.

any suggestions?

0 Karma

sundareshr
Legend

What error are you getting? You cannot see source when you use transaction. Remove the transaction command. You should still get the desired results. But, again, I think you will get an error when you click on the row generated by the sub-search.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...