Dashboards & Visualizations

Need your help to display a field value when mouse hover in any of the statistics table field value

rajaguru27902
New Member

Hi Team,

Need your help. We have a data as below. Now we have a field have message. From that EFFDATE,MEMID and MID has been derived. Now customer wants a drilldown. In statistics table if he do a mouse over on any of the fields EFFDATE,MEMID and MID the entire value in "message" field should be listed. It is like a mouseover in Column chart, Attached below. Please help me the logic. CSS/Script/Tokens. Expecting your help on this.

| makeresults count=3
| eval  message="Message"+" "+"14"+" "+"DUPLICATE"+" "+"MID"+"Mid"+":"+"103557"+"'"+"memId"+":"+"98"+"'"+"Eff Date"+":"+"Wed Nov 06 00:00:00 CST 2019"
|rex field="message" "(.*)(?<MID>\d\d\d\d\d\d)(.*)"  
|rex field="message" "(.*)(?<MEMID>\d\d)(.*)"   
|rex field="message" (.*(?<EFFDATE>\D\D\D\s\D\D\D\s\d\d\s\d\d:\d\d:\d\d\s\D\D\D\s\d\d\d\d))
| fields - _time



  EFFDATE                             MEMID          MID           message
    Wed Nov 06 00:00:00 CST 2019           19           103557     Message 14 DUPLICATE MIDMid:103557'memId:98'Eff Date:Wed Nov 06 00:00:00 CST 2019
    Wed Nov 06 00:00:00 CST 2019           19           103557   Message 14 DUPLICATE MIDMid:103557'memId:98'Eff Date:Wed Nov 06][1]
Tags (1)
0 Karma

rajagurup
New Member

Please update on this query

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...