Is there a way to setup a condition for drilldown ...

kiamco · ‎08-13-2018

So I have to scenarios

When user click on the no-event value a dashboard appers with a query that would probably contain something like:

level=$level$ NOT event=*
|eval ms_region=rtrim(ms_zone, "abcdefgh")
|where ms_region="$region$"

When user click on any event that is not labeled as 'no-event' search would be something like:

level=$level$
event=$event$
|eval ms_region=rtrim(ms_zone, "abcdefgh")
|where ms_region="$region$"

renjith_nair · ‎08-14-2018

@kiamco,

Try this <eval token="event_token">if($click.value2$=="","*",$click.value2$)</eval>

Sample dashboard with run anywhere example

<dashboard>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults count=5|eval event="someevenet",noevent=""</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <eval token="event_token">if($click.value2$=="","*",$click.value2$)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html>
      <h1>This is the token value : <font color="red">$event_token$</font></h1>
    </html>
  </row>
</dashboard>

---
What goes around comes around. If it helps, hit it with Karma 🙂

Is there a way to setup a condition for drilldown based on the clickvalue?

Can’t make it to .conf25? Join us online!

Splunkbase Unveils New App Listing Management Public Preview

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Are you a member of the Splunk Community?

Is there a way to setup a condition for drilldown based on the clickvalue?

Can’t make it to .conf25? Join us online!

Splunkbase Unveils New App Listing Management Public Preview

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain