Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Is there anyway to pass $row.field_name$ without c...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to get field values after a search finishes and pull fields from the finished search and set those values as tokens. i'm using $row.field_name$ but it's literally passing that text rather than the values.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it a table that is your output? You can try $result.field_name$ instead
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it a table that is your output? You can try $result.field_name$ instead
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
got it. thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Vijeta
When using $result.field_name$, it's passing the name of the column instead of value of that column.
And it's still not passing the tokens automatically. I still have to click on the result of previous dashboard.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it a table that is your output? You can try $result.field_name$ instead
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it is a table. and i did try it and it is working. is this documented? i could not find that.
thanks a million.
PS. i can't mark this as resolved for some reason.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please accept the answer if the problem is resolved. I am not sure if its documented.
I converted it to answer , you should be able to mark it resolve now.
Good Sourcetype Naming
See your relevant APM services, dashboards, and alerts in one place with the updated ...
Splunk App for Anomaly Detection End of Life Announcement
