drilldown click value issue

[ypfbkg]

I have a hiddensearch：sourcetype="etrexacclog" instance="$instance$"

$instance$ is my click value

this click value is "server1:8080",but in my data , field instance data is "server:8080" or "server.ad.com:8080"

How could I set the click value to server1*:8080 (server1:8080 ==> server1*:8080)

Thanks.

[eelisio2 · Accepted solution]

The replace() function should help:

sourcetype="etrexacclog"
| eval myfield="$instance$"
| eval myfield=replace(myfield,":",".ad.com:")
| where like(instance,"$instance$") OR like(instance,myfield)

[eelisio2]

Glad to help. Good luck.

[ypfbkg]

Hi eelisio2,

Thanks for your help. it works now.
and i learned the where function

[ypfbkg]

Hello jdunlea_splunk,
yes, click.value is different from the actual value of the field in the raw data.

raw data have two "server1:8080" & "server1.ad.com:8080"
click.value only "server1:8080"
i need click.value be "server1*:8080" to search "server1:8080" & "server1.ad.com:8080"

[RicoSuave]

can you please post all of your advanced xml?

[jdunlea_splunk]

Im not sure I understand? - If in your data, the value of "instance" is X, then the value of the click value should be X?

Are you saying that the click.value is different from the actual value of the field in the raw data??