Dashboards & Visualizations

How to pass more than 2 values when clicking on a row for drill down search?

asingla
Communicator

SimpleResultTable passes the value for the fist column as click.value when user clicks on a row. Is it possible to have access of all the column values (click.value2, click.value3...) when user clicks on a row for the drill down search?

2) Is it possible to hide a column (first one) in the SimpleResultTable and then pass this hidden column value when user clicks on a row?

wwhitener
Communicator

Splunk lets you record 4 values from a click.

click.name = click.value
click.name2 = click.value2

I'd suggest using a simple header to make sure that those cover whatever values you want--especially if you end up with a split-by clause in your query. Since you can nest the tables, you might be able to do more, but I haven't tried it. Otherwise, give the sideview stuff a try and let us know how it works out.

0 Karma

sideview
SplunkTrust
SplunkTrust

click.name and click.value are the column header, and the cell value, respectively, of the first column. Sorry for extra commas but it's a mouthful. As for click.name2 and click.value2 -- in "row" drilldown where the entire row lights up yellow onmouseover, those will always be identical to the first pair. In "cell" aka "all" configuration, those will be the column and cell value respectively of the cell that the user happened to click on. Unfortunately outside of occasional "split by" use cases, you'll usually be using "row" drilldown, and as such you really only have the first cell.

0 Karma

sideview
SplunkTrust
SplunkTrust

The first is not possible with just the core SimpleResultsTable. However if you use Sideview Utils ( http://splunk-base.splunk.com/apps/22279/sideview-utils ) in your app, and you follow it's instructions and embedded documentation, its code patches the SimpleResultsTable module to provide additional keys.

Specifically, you get $click.fields.someFieldName$ $click.fields.someOtherFieldName$, etc... for all the cells in the row, and you also get $click.cell0.value$, $click.cell7.value$, in case that's ever useful...

As far as your second question, I have implemented this in several apps, but only by adding some custom code to the app. I'm afraid the approach is a little too involved to lay out here.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...