Dashboards & Visualizations

how to disable particular column to drilldown and other should be enabled to drilldown the functionality

DataOrg
Builder

I have a 10 column where 7 of the columns pass tokens to the other dashboard but i need to disable other 3 columns which should not refresh/pass the value in the token

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi premranjithj,
let me understand:

  • you have ten fields in a search,
  • you want display only seven columns,
  • you want to use seven of the ten columns as token; is it correct?

if this is your need you have only to remove the three fields from the search, to do this you have two methods:

  • if you have a table command, you only have to list the seven fields,
  • if you haven't the field list, you can use the fields command at the end of your search in this way:

    |...
    | fields - column8 - column9 - column10

It's a different thing if you have some columns to use for tokens but you don't want to display.
In this case, you list all fields in your search, then add the tag

<fields> column1, column2, column3, column4, column5, column6, column7</fields>

In this way you have all ten fields for tokens and you display only seven columns.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...