Dashboards & Visualizations

Using a Column not in the table for a drilldown link (without using <fields> tag)

jamieadahan
Path Finder

I need to use a field for a drill-down link that can't be in the table Normally I would use the answer from here  which is to use the <fields> tag in the XML area however since I have a multi-select in my search which adds to the tables <fields> wont work.  In the Link I posted someone suggested that I use an underscore however that did work for me. Can anyone tell me what I am doing wrong here? or if there is a way to use <fields> with a multi-select. The token $fieldsANI$ is my multi-select

 

 

 <panel depends="$ShowANI$">
      <input type="multiselect" token="fieldsANI" searchWhenChanged="true" id="resized_input1">
        <label>Add other Fields</label>
        <choice value="Codec">Codec</choice>
        <choice value="Codec_List">Codec_List</choice>
        <choice value="Dis_Init">Dis_Init</choice>
        <choice value="Sip_Resp">Sip_Resp</choice>
        <choice value="rnum">rnum</choice>
        <choice value="Minutes">Minutes</choice>
        <delimiter> </delimiter>
<search>
          <query> ANI=$ANI$ 
| fillnull   
| eval Caller_Location=if(isnull(Caller_Location),"UnKnown",Caller_Location)
 
by Caller_Location,Routing_Location,rdest,Called_Country_ID,$fieldsANI$
| eval Routing_Location=Routing_Location+" ("+rdest+")"
| eval rdest=_rdest
| eval Called_Country_ID=_Called_Country_ID
| table Caller_Location,Routing_Location,_rdest,_Called_Country_ID,$fieldsANI$
| fields - Seconds
| sort -Attempts</query>
          <earliest>$Time_Range.earliest$</earliest>
          <latest>$Time_Range.latest$</latest>
        </search> 
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="wrap">false</option>
        <drilldown>
            <link target="_blank">https://art.comp.net/#/routing?country=$row._Called_Country_ID$&amp;location=$row._rdest$</link>
        </drilldown>

 

 

Labels (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

I think that is because 

"$fieldsANI$"

resolves to "Codec,Codec_List" for example. While you would need "Codec","Codec_List".

Playing around with the token prefix/suffix/delimeter settings on the multiselect might provide a way to format the content of the token in a way that it does work (and still works in the table command as well).

View solution in original post

0 Karma

FrankVl
Ultra Champion

Did some piece of the query go missing where that blank line is? If this is how it actually is in your dashboard, that might explain why the query doesn't work.

Also, I think this eval is the wrong way around:

| eval Called_Country_ID=_Called_Country_ID

Also, not entirely sure why you can't use the <fields> approach here. You can also use the token inside that <fields> definition, right? 

0 Karma

jamieadahan
Path Finder

Hi @FrankVl  Let me share with you the full query with the links  this is it with attempting to use the <fields> tag 

The Drill-down part works however when I try to add fields into the multi-select the table doesn't add those fields in

 <row>
    <panel depends="$ShowANI$">
      <input type="multiselect" token="fieldsANI" searchWhenChanged="true" id="resized_input1">
        <label>Add other Fields</label>
        <choice value="Codec">Codec</choice>
        <choice value="Codec_List">Codec_List</choice>
        <choice value="Dis_Init">Dis_Init</choice>
        <choice value="Sip_Resp">Sip_Resp</choice>
        <choice value="rnum">rnum</choice>
        <choice value="Minutes">Minutes</choice>
        <delimiter> </delimiter>
      </input>
      <table>
        <title>ANI  Analysis (ANI Specified in Filter - use OR for multiple ANI's)</title>
        <search>
          <query>index=cdr_sbc2 ANI=$ANI$ Call_Ty=3 Called_Country=* | fillnull    | eval Caller_Location=if(isnull(Caller_Location),"UnKnown",Caller_Location)  | eval Market_Maker=if(isnull(Market_Maker),"Can't Find",Market_Maker) |stats count(_raw) AS Attempts, count(eval(Sip_Resp="200")) as Completed, count(eval(Dur="0")) as Zero_Duration, sum(Dur) AS Seconds by OTG,OTG_acctName,DTG,DTG_acctName,ANI,Caller_Location,Routing_Location,Market_Maker,direct_cic,rdest,Called_Country_ID,$fieldsANI$
| eval ASR=round(Completed/Attempts*100,2)
| eval Minutes=round(Seconds/60,1)
| eval ALOC=round(Minutes/Completed,2)
| eval DTG_acctName=DTG_acctName+" ("+direct_cic+")"
| eval Routing_Location=Routing_Location+" ("+rdest+")"
| table OTG,OTG_acctName,DTG,DTG_acctName,ANI,Attempts,Completed,Caller_Location,Routing_Location,rdest,Called_Country_ID,ALOC,ASR,$fieldsANI$,Market_Maker
| fields - Seconds
| sort -Attempts</query>
          <earliest>$Time_Range.earliest$</earliest>
          <latest>$Time_Range.latest$</latest>
        </search> 
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="wrap">false</option>
        <fields>["OTG","OTG_acctName","DTG","DTG_acctName","ANI","Attempts","Completed","Caller_Location","Routing_Location","ALOC","ASR","$fieldsANI$","Market_Maker"]</fields>
        <drilldown>
            <link target="_blank">https://art.comp.net/#/routes?country=$row.Called_Country_ID$&amp;location=$row.rdest$</link>
        </drilldown>
      </table>
    </panel>
  </row>

 

0 Karma

FrankVl
Ultra Champion

I think that is because 

"$fieldsANI$"

resolves to "Codec,Codec_List" for example. While you would need "Codec","Codec_List".

Playing around with the token prefix/suffix/delimeter settings on the multiselect might provide a way to format the content of the token in a way that it does work (and still works in the table command as well).

0 Karma

jamieadahan
Path Finder

@FrankVl So this Semi worked as when I played around with it I did get it to work however i believe the <fields> tag does refresh as much as the table does so when I took out some values and added others in the table would keep what the fields tag had in it originally. I had to refresh the page for it to add the next multi-select input. Is there a way I can force a refresh?

0 Karma

jamieadahan
Path Finder

@FrankVl  I found the Answer in this post I see your original point was correct i had it wrong

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...