How to use token for a regex in splunk dashboard drilldown?

[niks987]

Hi All,

I have written a query where I am selecting name of the user and device using regex. While trying to do drill down in splunk dashboard i'm unable to get results for name and device.

Also i have tried using click.name and click.value but results are not populating.

Please find below the query and snap of source:-

index=* source="/export/home//apawatch."
| rex field=source "^\/export\/home\/(?\w+)\/apawatch.(?\w+)$"
| timechart count by device

Source:-

<panel>
      <title>Total Events by Name</title>
      <chart>
        <search>
          <query>index=* source="/export/home/*/apawatch.*" 
| rex field=source "^\/export\/home\/(?&lt;name&gt;\w+)\/apawatch\.(?&lt;device&gt;\w+)$$" 
| timechart count by name</query>
          <earliest>$timeselected.earliest$</earliest>
          <latest>$timeselected.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="name">$click.name$</set>
        </drilldown>
      </chart>
    </panel>
    <panel>
      <title>Events by Device</title>
      <chart>
        <search>
          <query>index=* source="/export/home/*/apawatch.*"
| rex field=source "^\/export\/home\/(?&lt;name&gt;\w+)\/apawatch\.(?&lt;device&gt;\w+)$$" 
| timechart count by device</query>
          <earliest>$timeselected.earliest$</earliest>
          <latest>$timeselected.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="device">$click.name$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$name$">
      <table>
        <title>Events By Name</title>
        <search>
          <query>index=* source="/export/home/*/apawatch.*" earliest=-1m latest=now name="$name$"
| rex field=source "^\/export\/home\/(?&lt;name&gt;\w+)\/apawatch\.(?&lt;device&gt;\w+)$$" 
| table _time,name  </query>
          <earliest></earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="name">$row.&lt;fieldname&gt;$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$device$">
      <table>
        <title>Event By Device</title>
        <search>
          <query>index=* source="/export/home/*/apawatch.*" earliest=-1m latest=now device="$device$"
| rex field=source "^\/export\/home\/(?&lt;name&gt;\w+)\/apawatch\.(?&lt;device&gt;\w+)$$" 
| table _time,device</query>
          <earliest></earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>

Thanks in advance 🙂

[renjith_nair · Accepted solution]

@niks987,

$click.name$ is a predefined token which provides you the leftmost field (column) name in the table or in case of a chart , X-axis field or category name for the clicked location.
Refer - https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/PanelreferenceforSimplifiedXML#Predefined_dri...

To get the field value of field name, use $row.name$

i.e.

         <drilldown>
           <set token="name">$row.name$</set>
         </drilldown>

Similarly for device, use $row.device$

[niks987]

I tried using $row.name$ but still its not working.

[renjith_nair]

@niks987, sorry overlooked at the visualization.

Try click.name2

<set token="name">$click.name2$</set>

Here is a run anywhere example with the drilldown on stacked column chart. Clicking on the graph gives back the corresponding name in the title.

<dashboard>
  <label>Name Drilldown</label>
  <row>
    <panel>
      <title>$name$</title>
      <chart>
        <search>
          <query>index=_internal|rex field=source "(?&lt;name&gt;.+).log"|timechart count by name</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="name">$click.name2$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
</dashboard>