I have created two panels
My first panel details are:
<![CDATA[index=abc ns=blazegateway app_name=blazecrsgateway* "serviceResponseStatus" $Ope$ $caller$ $status$
|rex field=_raw "operation:(?P<Operation>.*), serviceResponseStatus"
|rex field=_raw "caller:(?P<Caller>.*) =" |rex field=_raw "serviceResponseTime\(ms\)=(?P<Response_Time>.*)"
| eventstats count by Caller|rename Caller as "GRS Caller"
|lookup ApplicationRef.csv GRSCaller as "GRS Caller" OUTPUT DisplayName
|rename "GRS Caller" as "GRSCaller"
| table CallerName Operation Response_Time serviceResponseStatus date|rename CallerName as "GRS Caller"
| rename date as "Date" | rename serviceResponseStatus as "Response_Status"|sort - Date]]>
From this I am getting details as below:
GRS Caller Operation ResponseTime Status Date
OneForce ls 286 ms Success 2022-06-27OneForce dmrupload 381 ms Failure 2022-06-27
I want when I click on 1st row the detailed description of 1st row should come.
Can someone guide me what query I can make for 2nd panel extraction
Currently I have make this but its not working
<query>abc ns=blazegateway app_name=blazecrsgateway* "serviceResponseStatus" $Ope$ $caller$ $status$ $selected_value$ </query>
Where does your 'detailed description' come from and what would be the search that finds this - you are just using the token $selected_value$
$click.value$ will not be useful for the drilldown - your drilldown setting should be "row" and the tokens set should be
<set token="selected_caller">$row.GRS Caller$</set>
However, you are doing lots of other stuff in your original search which means the clicked row will not be useful for the search, e.g. you extract Operation via a rex statement.
It would be better to just 'save' all the fields you want from the first search and then display them with a simple query in the second panel.
i.e. collect ALL the fields you want into the table statement in the first search. Then add
in the XML to restrict what fields are shown
in the second panel just make the query do something like
| eval GRS_Caller=$selected_caller$
| eval Operation=$selected_op$
... other eval statements to assign fields from tokens
| table your_wanted_fields