Using Drilldown to search for a value in a look up to set a token

[robertlynch2020]

Hi

I am trying to set a token from a drilldown.

I am able to to this, however the value that comes back is only for display, the real value is in a lookup table.

NICKNAME    Human_Name_Nickname
mx  MX_BASIC
smcrisk_engine  RISK_ENGINE
mxtraderepository_engine    MX_TRADE_REPO_ENGINE
smcobjectrepository_engine  SM_ENGINE
mxmlexchange_mxtaskxa   MXMLEXCHANGE
mxdealscanner_engine    DEAL_SCANNER
mx_cesar    CESAR
mx_marketdata_repository_engine MARKET_DATA
mxprocessingscript  PROCESSING_SCRIPT

So i need to take the value on the screen go to the look up and comeback with the real value.
I am trying to do this by taking $trellis.value$, putting it into a lookuptable and getting back the correct answer.

So for example, i display "MX_BASIC", i want to set the token to "mx" as this is the underlining value i need to pass into the token.

<drilldown>
          <!--set token="form.NICKNAME_TOKEN">$trellis.value$</set-->
          <set token="SINGLE_CLICK_NICKNAME">ON</set>
           <eval token="form.NICKNAME_TOKEN">| inputlookup  TEST_MXTIMING_NICKNAME.csv |  search Human_Name_Nickname = $trellis.value$ | fields - Human_Name_Nickname</eval>
        </drilldown>

[niketn · Accepted solution]

@robertlynch2020, you can pass on the token from trellis drilldown to a search which can perform inputlookup to fetch the result and set the form variable through Search Event Handler.

Add the following new search to your dashboard (below description)

    <search>
      <query>| inputlookup  TEST_MXTIMING_NICKNAME.csv where Human_Name_Nickname = "$trellis.value$" | fields NICKNAME
      </query>
      <progress>
          <set token="form.NICKNAME_TOKEN">$result.NICKNAME$</set>
      </progress>
    </search>

Modify your Trellis drilldown code to pass on clicked value as token to the search.

    <drilldown>
       <set token="tokHumanNameNickName">$trellis.value$</set>
       <set token="SINGLE_CLICK_NICKNAME">ON</set>
    </drilldown>

PS: Use of eval to set token can only perform eval functions that too with some restrictions which you should check in Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

[robertlynch2020]

Cheers. Great stuff.