Dashboards & Visualizations

Is there a way to setup a condition for drilldown based on the clickvalue?

Path Finder

So I have to scenarios

When user click on the no-event value a dashboard appers with a query that would probably contain something like:

level=$level$ NOT event=*
|eval ms_region=rtrim(ms_zone, "abcdefgh")
|where ms_region="$region$"

When user click on any event that is not labeled as 'no-event' search would be something like:

level=$level$
event=$event$
|eval ms_region=rtrim(ms_zone, "abcdefgh")
|where ms_region="$region$"
0 Karma

SplunkTrust
SplunkTrust

@kiamco,

Try this <eval token="event_token">if($click.value2$=="","*",$click.value2$)</eval>

Sample dashboard with run anywhere example

<dashboard>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults count=5|eval event="someevenet",noevent=""</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <eval token="event_token">if($click.value2$=="","*",$click.value2$)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html>
      <h1>This is the token value : <font color="red">$event_token$</font></h1>
    </html>
  </row>
</dashboard>
0 Karma