Dashboards & Visualizations

Single Value Drilldown not working

dwibedi03
Explorer

<drilldown>
<set token="tok_port57">$click.name$</set>
</drilldown>

<row depends="$tok_port57$">
<panel>
<title>Port 57 Details</title>
<table>
<search>
<query>index=email | transaction keepevicted=true ic | eval port = if(match(sender_group,"Secure_*"),"Port_57","Port_5") |search port= "$tok_port57$" | stats count by src src_host</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>

This is the drilldown setting for the single value. However instead of getting the field name as the token value, the keyword "result" is getting passed as token. Can someone tell me what I am doing wrong?

Labels (3)
0 Karma

FelixLeh
Path Finder

Hi, 
I'm pretty new to Splunk so take what I say with a grain of salt.. 
but I think you want a value in the drilldown token from somewhere and not the name of the field, right?
$click.name$ outputs the fieldname and not value.. 
If you click on a value in the field "result" in your current dashboard would explain the situation.. 

I think :
<drilldown>
<set token="tok_port57">$click.value$</set>
</drilldown>

would make more sense in this situation if I understand your scenario, since it writes the value of the clicked field into the token!

0 Karma

dwibedi03
Explorer

I need the name of the field in this case Port_5. My main search is similar to the search for the drilldown.

0 Karma

FelixLeh
Path Finder

ah ok I see I misread your question! 
Well then it surely is weird the token is set to result.. 
The only other idea I have is the fact that the drilldown always picks the value/fieldname of the leftmost field in the table you click.. so maybe your port field isn't the leftmost field? If so you could use $click.name2$ which always picks the exact fieldname of the one you clicked..

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>