Dashboards & Visualizations

Need your help to display a field value when mouse hover in any of the statistics table field value

rajaguru27902
New Member

Hi Team,

Need your help. We have a data as below. Now we have a field have message. From that EFFDATE,MEMID and MID has been derived. Now customer wants a drilldown. In statistics table if he do a mouse over on any of the fields EFFDATE,MEMID and MID the entire value in "message" field should be listed. It is like a mouseover in Column chart, Attached below. Please help me the logic. CSS/Script/Tokens. Expecting your help on this.

| makeresults count=3
| eval  message="Message"+" "+"14"+" "+"DUPLICATE"+" "+"MID"+"Mid"+":"+"103557"+"'"+"memId"+":"+"98"+"'"+"Eff Date"+":"+"Wed Nov 06 00:00:00 CST 2019"
|rex field="message" "(.*)(?<MID>\d\d\d\d\d\d)(.*)"  
|rex field="message" "(.*)(?<MEMID>\d\d)(.*)"   
|rex field="message" (.*(?<EFFDATE>\D\D\D\s\D\D\D\s\d\d\s\d\d:\d\d:\d\d\s\D\D\D\s\d\d\d\d))
| fields - _time



  EFFDATE                             MEMID          MID           message
    Wed Nov 06 00:00:00 CST 2019           19           103557     Message 14 DUPLICATE MIDMid:103557'memId:98'Eff Date:Wed Nov 06 00:00:00 CST 2019
    Wed Nov 06 00:00:00 CST 2019           19           103557   Message 14 DUPLICATE MIDMid:103557'memId:98'Eff Date:Wed Nov 06][1]
Tags (1)
0 Karma

rajagurup
New Member

Please update on this query

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...