Dashboards & Visualizations

drilldown based on token length

jiaqya
Builder

hi, could i get help on how to trigger different drilldown based on token length.

for ex: my token is 12345
so if my token length is 5 , i would like to trigger https://test12345
else
trigger the drilldown to https://test1234567890

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @jiaqya,

Can you please try this drilldown?

<drilldown>
          <condition match="len('click.value')=5">
            <link target="_blank">https://test12345</link>
          </condition>
          <condition>
            <link target="_blank">https://test1234567890</link>
          </condition>
        </drilldown>

Sample Dashboard:

<dashboard>
  <label>Drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval field1="12345,1234567890" | eval field1=split(field1,",") | mvexpand field1 | table field1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition match="len('click.value')=5">
            <link target="_blank">https://test12345</link>
          </condition>
          <condition>
            <link target="_blank">https://test1234567890</link>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @jiaqya,

Can you please try this drilldown?

<drilldown>
          <condition match="len('click.value')=5">
            <link target="_blank">https://test12345</link>
          </condition>
          <condition>
            <link target="_blank">https://test1234567890</link>
          </condition>
        </drilldown>

Sample Dashboard:

<dashboard>
  <label>Drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval field1="12345,1234567890" | eval field1=split(field1,",") | mvexpand field1 | table field1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition match="len('click.value')=5">
            <link target="_blank">https://test12345</link>
          </condition>
          <condition>
            <link target="_blank">https://test1234567890</link>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

jiaqya
Builder

Thanks, will try this and get back with result..

0 Karma

jiaqya
Builder

Kamlesh, that worked perfectly fine, thank you.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jiaqya,
Glad to help you.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...