In doing a little research we found a similar thread on Splunk Answers with the possible solution however there are somethings that we need clarifying. Here's the URL to the Splunk Answers for reference: https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-use-a-value-from-a-different-fiel...
Basically we have a search results with 5 columns and 10 rows containing random numbers on each cell and the requirement to is click into one of the numbers in the cells and open a new tab to another search or lookup file. According to the Splunk Answer thread there's an option or variable for $row.column_one$, $row.column_two$, $row.column_three$... that can be used. Here's snippet of the thread:
Is this true/correct? How do we set or call these variables to point to a specific row.column.number for the $click.value$ ? Is this based on or using a <condition> ?
Thanks in advanced for your help.
Refer to specific fields ("columns") by their names. If the field is called "column_two" then the token is $row.column_two$, but if the second column is called "Foo" then the token is $row.Foo$.
Thanks again for the response. After reviewing the link to the documentation, it does not (or at least from reading it) the documentation did not include specific situations of having or using <condition> statement i.e. field="Network"> for a specific cell and depending on the cell selected/clicked, drilling down in to it and running another search or going to a lookup file.
Here's a screenshot of the example from the documentation:
We've tried setting the token to one column heading name with no luck so far. As a test we tried defining or setting the token as one cell or $row.col1_PKIenabled$ in this case "col1_Network" is the same field generated/used by the stats command or "mySearch | stats count as "col1_Network".
Below is an example of out the output of the Search. Do we need to define a token for each possible cell or row/column combination since each cell has it's own target lookup file? Any thoughts? Thanks.
Simple answer is no, you don't have to have a condition for each combination, you can have a condition that applies to all (unspecified) fields. However, it depends on what lookups you want to do. For example, if your lookup is made up of the column name and row value you could use $click.name2$$click.value$ as the value you pass in the drilldown link.
Thank you for the response.
Each cell will have a lookup file with the details of what made up the value or number of the cell. For example, if cell A5 or column A row 5 has the number 5 the lookup will contain 1+1+1+2. Or another example if cell C6 has the value 100 the lookup file will contain 10+10+80, and so on. There is no other action for the lookup file except to provide details.
Could you please clarify how can a single condition be applied to all unspecified fields/cells?
Do you mean you have a single lookup file with rows corresponding to each value on every cell?
Or, do you have a lookup file for each value e.g. 5.csv, 100.csv, which has a single row(?) containing the makeup of the number?
To apply a drilldown to all cells, don't use condition. If you already have (to use) conditions, then a condition without a field reference will apply to any field which hasn't already been specified
<drilldown> <condition field="a"> <link>link applies for selections in field a</link> </condition> <condition> <link>link applies for all previously unmentioned fields</link> </condition> </drilldown>
Thanks for replying.
Each cell will have its own lookup file which is the challenge. We are already able to successfully use one lookup file but the requirement is for each cell to have its own unique lookup file.
Any thoughts? Thanks.
As I said earlier, you could use the value from the row and the column concatenated together $click.name2$$click.value$ as one of the query parameters you include in the drilldown link e.g. /app/appname/viewname?form.lookup=$click.name2$$click.value$
Your target dashboard would have a hidden input text box so that you can then have a panel with
| inputlookup $form.lookup$