Dashboards & Visualizations

how to disable particular column to drilldown and other should be enabled to drilldown the functionality


I have a 10 column where 7 of the columns pass tokens to the other dashboard but i need to disable other 3 columns which should not refresh/pass the value in the token

0 Karma

Esteemed Legend

Hi premranjithj,
let me understand:

  • you have ten fields in a search,
  • you want display only seven columns,
  • you want to use seven of the ten columns as token; is it correct?

if this is your need you have only to remove the three fields from the search, to do this you have two methods:

  • if you have a table command, you only have to list the seven fields,
  • if you haven't the field list, you can use the fields command at the end of your search in this way:

    | fields - column8 - column9 - column10

It's a different thing if you have some columns to use for tokens but you don't want to display.
In this case, you list all fields in your search, then add the tag

<fields> column1, column2, column3, column4, column5, column6, column7</fields>

In this way you have all ten fields for tokens and you display only seven columns.


Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...