I have table with just 2 columns 'Name' and 'Value'. one of the rows has the 'Value' as 'Fail', 'Pass' or 'NA'
I have another table, which has a bunch of related data. I have 2 options for the second table:-
1. I want the query for table 2 to run only when the 'Value' in the first table is 'Fail' and the table 2 to remain hidden
OR
2. but I want that table to be only displayed when the 'Value' in the first table is 'Fail'
Can you please try this xml?
<form>
<label>Table Depend</label>
<row>
<panel>
<table>
<title>First Table</title>
<search>
<query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<condition match="match($row.val$, "Fail")">
<set token="tkn_value">$row.val$</set>
</condition>
<condition>
<unset token="tkn_value" />
</condition>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<table depends="$tkn_value$">
<title>Second Table with value $tkn_value$</title>
<search>
<query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val | where val="$tkn_value$"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
i added this portion to my simple xml file in the first table
<drilldown> <condition match="match($row.val$, "Fail")"> <set token="tkn_value">$row.val$</set> </condition> <condition> <unset token="tkn_value" /> </condition> </drilldown>
and then
<table depends="$tkn_value$">
the above portion in the second table. but the second table always remains hidden for some reason no matter what the value is.
Note:- i changed the row.val as per my table requirement still its the same result.
Is it possible for you to share sample XML of both table.. replace search with dummy search.
Table 1
<table id="Table_1">
<title>Table 1</title>
<search id="Table_1">
<query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition match="match($row.val$, "Fail")">
<set token="tkn_value">$row.val$</set>
</condition>
<condition>
<unset token="tkn_value" />
</condition>
</drilldown>
<format type="color" field="Log">
<colorPalette type="list">[#FFFFFF,#DC4E41]</colorPalette>
<scale type="threshold">1</scale>
</format>
</table>
Table 2
<table id="Table_2" depends="$tkn_value$">
<title>Table 2</title>
<search id="base_search_35_1">
<query>
| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val | where val="$tkn_value$" </query>
</search>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
@sdhawanx Your code looks good and working in my instance also. Anything else you did with table drill down?
there is nothing else in the code apart from the changed query
for the second table i used only this part
| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val
and removed the last pipe. this is the only difference. But as per my understanding the code should still work fine. but the table remains hidden nonetheless.
i created a sample code on my local splunk and copied your code as is and it seemed to work just fine but when transferring it to the main code its not working
Can you please check the token value by printing it? Just do below changes.
<drilldown>
<condition match="match($row.value$, "Fail")">
<set token="tkn_value">$row.value$</set>
<unset token="tkn_value_tmp" />
</condition>
<condition>
<unset token="tkn_value" />
<set token="tkn_value_tmp">$row.value$ Negative</set>
</condition>
</drilldown>
Add below
<row>
<panel>
<html>$tkn_value$<br />
$tkn_value_tmp$</html>
</panel>
</row>
Just observe the behaviour of both token. It will help you to debug more.
I will test this once i return to work. Thanks for the prompt response. Very much appreciated