Dashboards & Visualizations

drilldown based on token length

jiaqya
Builder

hi, could i get help on how to trigger different drilldown based on token length.

for ex: my token is 12345
so if my token length is 5 , i would like to trigger https://test12345
else
trigger the drilldown to https://test1234567890

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @jiaqya,

Can you please try this drilldown?

<drilldown>
          <condition match="len('click.value')=5">
            <link target="_blank">https://test12345</link>
          </condition>
          <condition>
            <link target="_blank">https://test1234567890</link>
          </condition>
        </drilldown>

Sample Dashboard:

<dashboard>
  <label>Drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval field1="12345,1234567890" | eval field1=split(field1,",") | mvexpand field1 | table field1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition match="len('click.value')=5">
            <link target="_blank">https://test12345</link>
          </condition>
          <condition>
            <link target="_blank">https://test1234567890</link>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @jiaqya,

Can you please try this drilldown?

<drilldown>
          <condition match="len('click.value')=5">
            <link target="_blank">https://test12345</link>
          </condition>
          <condition>
            <link target="_blank">https://test1234567890</link>
          </condition>
        </drilldown>

Sample Dashboard:

<dashboard>
  <label>Drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval field1="12345,1234567890" | eval field1=split(field1,",") | mvexpand field1 | table field1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition match="len('click.value')=5">
            <link target="_blank">https://test12345</link>
          </condition>
          <condition>
            <link target="_blank">https://test1234567890</link>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

jiaqya
Builder

Thanks, will try this and get back with result..

0 Karma

jiaqya
Builder

Kamlesh, that worked perfectly fine, thank you.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jiaqya,
Glad to help you.

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...