I am trying to define a drilldown within a splunk form. However, when i click the row, it passes the variable $row.rid$ instead of the value.
Can someone where help what i am doing wrong?
Here is the code
<panel> <table> <title>Error Details</title> <search> <query>host="vmh001d009" index="coreservices" | transaction rid | search (level=ERROR OR level=FATAL) | rex field=url "http://(?<Service>[^/]+/[^/]+)" | eval Time=strftime(_time, "%H:%M %P %Z") | table Time, Service, funcname, user | rename funcname as Function, user as User</query> <earliest>$timeSelection.earliest$</earliest> <latest>$timeSelection.latest$</latest> </search> <drilldown> <link>/app/coreservicesmonitoring/ptpe__debug?form.rid=$row.rid$</link> </drilldown> <option name="wrap">false</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> <option name="drilldown">row</option> </table> </panel>
Here is what it resolves too; (note form.rid=%24row.rid%24 )
For this to work, there will have to be
rida field that appears in the final table and you have displayed among the fields you want to display with the control table, I see no
for the syntax of the drilldown tag, everything is correct and should work.
try as I say, and let me know.
Here the sample code I used recently and it retrieves the exact value.
<panel> <table id="master"> <title>Tickets for $host$, $status$, generated by Error_alert, triggered</title> <search> <query>index=ticket report="ticket1" $host$ $TicketNumber$ $status$ $comment$ |dedup TicketNumber |table TicketNumber Alerttime status Comments Raw </query> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <drilldown> <!-- Use set to specify the new token to be created. Use any token from the page or from the click event to produce the value needed. --> <link>/app/CPU/tickets_list2?form.TicketNumber=$row.TicketNumber$</link> </drilldown> <option name="count">10</option> </table> </panel>
please forgive My english
thanks, that worked! i assumed i could use any fields in underlying event, guess only those shown up in table can be passed.
Thanks again for your help