How to create an inline drilldown where clicking on a row in the table populates a drop-down form with 3 values?

[stephane_cyrill]

What I want to do is to change the status value with values from the a drop-down or textbox and display an upgraded drilldown page.

The following is my XML code with in page drilldown.

THE PROBLEM IS HOW TO ADD INPUTS ON THE DRILLDOWN PAGE.

Thanks in advance for your help.

SPLUNK MULTI-SELECT INPUT

     <input type="time" searchWhenChanged="true">
      <label>Select a time:</label>
      <default>Last 24 hours</default>
    </input>


    <input type="multiselect" token="status" searchWhenChanged="true">
     <label>Select a status:</label>
      <default>ALL</default>
        <!-- The final value will be surrounded by prefix and suffix -->
        <prefix>(</prefix>
        <suffix>)</suffix>
        <!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
        <valuePrefix>status="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
        <delimiter> OR </delimiter>

        <populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="status" fieldForValue="status">index=ticket |stats count by status | eval Label=status</populatingSearch>
     </input>  

     <input type="multiselect" token="host" searchWhenChanged="true">
      <label>Select a host:</label>
      <default>ALL</default>

        <!-- The final value will be surrounded by prefix and suffix -->
        <prefix>(</prefix>
        <suffix>)</suffix>
        <!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
        <valuePrefix>host="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
        <delimiter> OR </delimiter>
        <choice value="*">ALL</choice>
        <populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="host" fieldForValue="host">index=ticket |stats count by host| eval Label=host</populatingSearch>
     </input>

    <input type="text" token="TicketNumber" searchWhenChanged="true">
      <label>Enter a TicketNumber :</label>   
    </input>

  </fieldset>

  <row>

      <table id="master">
        <title>Table_of_the_alert </title>
        <searchString>index=ticket |eval TicketNumber=round(_time) |eval Raw=_raw | table TicketNumber _time host status source Raw app</searchString>

        <option name="drilldown">row</option>
            <drilldown>
                <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
                <set token="TicketNumber">$row.TicketNumber$</set>
                <!-- If we also set the form.User the input will get updated too -->
                <set token="form.TicketNumber">$row.TicketNumber$</set>
            </drilldown>
      </table>

  </row>



    <fieldset submitButton="true" autoRun="true">
     <input type="dropdown" token="status" searchWhenChanged="true">
      <label>Status</label>
      <choice value="&quot;*&quot;">All</choice>
      <default>"*"</default>
      <populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="Label" fieldForValue="status">index=ticket |stats count by status | eval Label=status</populatingSearch>
    </input>

     <input type="text" token="comment" searchWhenChanged="true">
      <label>Enter a Name of the comments :</label>   
    </input>
   </fieldset>

    <row>
        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->
        <table id="detail" depends="$TicketNumber$">
            <title>the events of this User for other files: $TicketNumber$</title>
            <searchTemplate>index=ticket $TicketNumber$ |table status source _raw </searchTemplate>

        </table>
    </row>


</form>

[gyslainlatsa]

hi,
try this

<form>
  <label>SPLUNK MULTI-SELECT INPUT</label>

  <fieldset submitButton="false" autoRun="true">

     <input type="time" searchWhenChanged="true">
      <label>Select a time:</label>
      <default>Last 24 hours</default>
    </input>


    <input type="multiselect" token="status" searchWhenChanged="true">
     <label>Select a status:</label>
     <choice value="*">ALL</choice>
      <default>*</default>
        <!-- The final value will be surrounded by prefix and suffix -->
        <prefix>(</prefix>
        <suffix>)</suffix>
        <!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
        <valuePrefix>status="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
        <delimiter> OR </delimiter>
        <choice value="Open">open</choice>
        <choice value="Closed">Closed</choice>
        <choice value="Inprogress">In progress</choice>

        <populatingSearch earliest="0" latest="now" fieldForLabel="status" fieldForValue="status">index=ticket |stats count by status | eval Label=status</populatingSearch>
     </input>  

     <input type="multiselect" token="host" searchWhenChanged="true">
      <label>Select a host:</label>
      <choice value="*">ALL</choice>
      <default>*</default>

        <!-- The final value will be surrounded by prefix and suffix -->
        <prefix>(</prefix>
        <suffix>)</suffix>
        <!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
        <valuePrefix>host="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
        <delimiter> OR </delimiter>

        <populatingSearch earliest="0" latest="now" fieldForLabel="host" fieldForValue="host">index=ticket |stats count by host| eval Label=host</populatingSearch>
     </input>

    <input type="text" token="TicketNumber" searchWhenChanged="true">
      <label>Enter a TicketNumber :</label>   
    </input>

  </fieldset>



  <row>

    <panel>

      <table>
        <title>Table_of_the_alert </title>
        <search>
          <query>index=ticket report="ticket1" $host$ $status$ |table TicketNumber Alerttime status host Raw Comments</query>    
        </search>

        <option name="drilldown">row</option>
            <drilldown>
                <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
                <set token="TicketNumber">$row.TicketNumber$</set>
                <!-- If we also set the form.User the input will get updated too -->
                <set token="form.TicketNumber">$row.TicketNumber$</set>
            </drilldown>
      </table>

  </panel>

  <panel id="detail" depends="$TicketNumber$">

     <input type="dropdown" token="status" searchWhenChanged="true">
      <label>Status</label>
      <choice value="Open">open</choice>
      <choice value="Closed">Closed</choice>
      <choice value="Inprogress">In progress</choice>
      <choice value="*">All</choice>
      <default>*</default>
      <populatingSearch earliest="0" latest="now" fieldForLabel="Label" fieldForValue="status">index=ticket |stats count by status | eval Label=status</populatingSearch>
    </input>

     <input type="text" token="comment" searchWhenChanged="true">
      <label>Enter your comments :</label>   
    </input>

        <!-- depends is the way we tell the content to only show when the token has a value.
             Hint: use comma separated values if the element requires more than one token. -->

        <table>
            <title>the events of this User for other files: $TicketNumber$</title>
            <searchTemplate>index=ticket report="ticket1" $TicketNumber$ |table Alerttime status Raw Comments</searchTemplate>

        </table>

    </panel>

   </row>

</form>