I have a Splunk table with three columns with headings.
I want to know how to add drill down/make one column only(first column) clickable and pass that value to all other panels.
Any help would be appreciated.
A B C
1 2 3
4 5 6
make column A as clickable only. user should be able to click only on 1 and 4 at a time and same shall be passed on the dashboard.
Hi
Try this
<dashboard>
<label>drilldown</label>
<row>
<panel>
<table>
<title></title>
<search>
<query>| makeresults
| eval A=1, B=2, C=3
| append
[| makeresults
| eval A=4, B=5, C=6]|table A B C</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<drilldown target="_blank">
<condition field="A">
<link>
<![CDATA[
/app/search/drilldown?value=$click.value$
]]>
</link>
</condition>
<condition field="B">
</condition>
<condition field="C">
</condition>
</drilldown>
</table>
</panel>
</row>
</dashboard>
with this,you are redirecting the url.
What is required here is ,On click the clickable value must got the other panels as input (which are in the same dashboard).
Hi
Check this, drilldown value will available in value
token
<dashboard>
<label>drilldown</label>
<row>
<panel>
<table>
<title>$value$</title>
<search>
<query>| makeresults
| eval A=1, B=2, C=3
| append
[| makeresults
| eval A=4, B=5, C=6]|table A B C</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<condition field="A">
<set token="value">$click.value$</set>
</condition>
<condition field="B">
</condition>
<condition field="C">
</condition>
</drilldown>
</table>
</panel>
</row>
</dashboard>