Dashboards & Visualizations

Is it possible to have a drilldown of a specific cell in a row using $click.value$

marceloalejandr
Path Finder

Aloha, 

In doing a little research we found a similar thread on Splunk Answers with the possible solution however there are somethings that we need clarifying.  Here's the URL to the Splunk Answers for reference:  https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-use-a-value-from-a-different-fiel...

Basically we have a search results with 5 columns and 10 rows containing random numbers on each cell and the requirement to is click into one of the numbers in the cells and open a new tab to another search or lookup file.   According to the Splunk Answer thread there's an option or variable for $row.column_one$, $row.column_two$, $row.column_three$... that can be used.  Here's snippet of the thread:

marceloalejandr_0-1640730153011.png

 

Is this true/correct?    How do we set or call these variables to point to a specific row.column.number for the $click.value$ ?     Is this based on or using a <condition> ?

Thanks in advanced for your help.  

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Refer to specific fields ("columns") by their names.  If the field is called "column_two" then the token is $row.column_two$, but if the second column is called "Foo" then the token is $row.Foo$.

---
If this reply helps you, Karma would be appreciated.
0 Karma

marceloalejandr
Path Finder

Rich, 

Thank you for your response.  Would it be possible to get an example and/or a link to any documentation?

Much appreciated. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Docs are here: https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/tokens

---
If this reply helps you, Karma would be appreciated.

marceloalejandr
Path Finder

Rich, 

Thanks again for the response.  After reviewing the link to the documentation, it does not (or at least from reading it) the documentation did not include specific situations of having or using <condition> statement i.e. field="Network"> for a specific cell and depending on the cell selected/clicked, drilling down in to it and running another search or going to a lookup file.  

Here's a screenshot of the example from the documentation:

marceloalejandr_1-1640811893425.png

We've tried setting the token to one column heading name with no luck so far.     As a test we tried defining or setting the token as one cell or $row.col1_PKIenabled$ in this case "col1_Network" is the same field generated/used by the stats command or "mySearch | stats count as "col1_Network".   

Below is an example of out the output of the Search.   Do we need to define a token for each possible cell or row/column combination since each cell has it's own target lookup file?   Any thoughts?  Thanks.

marceloalejandr_0-1640811860388.png

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer is no,  you don't have to have a condition for each combination, you can have a condition that applies to all (unspecified) fields. However, it depends on what lookups you want to do. For example, if your lookup is made up of the column name and row value you could use $click.name2$$click.value$ as the value you pass in the drilldown link.

0 Karma

marceloalejandr
Path Finder

Thank you for the response.

Each cell will have a lookup file with the details of what made up the value or number of the cell.  For example, if cell A5 or column A row 5 has the number 5 the lookup will contain 1+1+1+2.   Or another example if cell C6 has the value 100 the lookup file will contain 10+10+80, and so on.  There is no other action for the lookup file except to provide details.  

Could you please clarify how can a single condition be applied to all unspecified fields/cells?  

Thanks again.  

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean you have a single lookup file with rows corresponding to each value on every cell?

Or, do you have a lookup file for each value e.g. 5.csv, 100.csv, which has a single row(?) containing the makeup of the number?

To apply a drilldown to all cells, don't use condition. If you already have (to use) conditions, then a condition without a field reference will apply to any field which hasn't already been specified

<drilldown>
  <condition field="a">
    <link>link applies for selections in field a</link>
  </condition>
  <condition>
    <link>link applies for all previously unmentioned fields</link>
  </condition>
</drilldown>
0 Karma

marceloalejandr
Path Finder

Thanks for replying. 

Each cell will have its own lookup file which is the challenge.   We are already able to successfully use one lookup file but the requirement is for each cell to have its own unique lookup file. 

Any thoughts?   Thanks.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I said earlier, you could use the value from the row and the column concatenated together $click.name2$$click.value$ as one of the query parameters you include in the drilldown link e.g. /app/appname/viewname?form.lookup=$click.name2$$click.value$

Your target dashboard would have a hidden input text box so that you can then have a panel with 

| inputlookup $form.lookup$
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...