drilldown of the values

[splunkpoornima]

I got the following output by using the below code...

index values(sources)

main c://taskmanager/taskmanager_log

list continues....

<?xml version='1.0' encoding='utf-8'?>

pros_automatic

index=*|chart values(source) by index /app/search/flashtimeline?q=values(source)=$row.source$|transaction TaskBP startswith=START endswith=Succeeded|table TaskBP Duration

My requirement is if click the specific source i want see the query in the search ber as

index="main" source="c://taskmanager/taskmanager_log"|transaction TaskAction startswith=START endswith=Succeeded|

plz verify the code..and give suggestion

[Leo]

try this:
...
index=|chart values(source) **as source* by index

/app/search/flashtimeline?q=index=$row.index$ source=$row.source$|transaction TaskBP startswith=START endswith=Succeeded|table TaskBP Duration
...

[Leo]

Also, note that this will only work on Splunk 5.0
If you're on an older version, you should use advanced xml drilldown.